# NIST 800-171 3.7.2 Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

- Source: https://support.icompaas.com/support/solutions/articles/62000229305-nist-800-171-3-7-2-provide-controls-on-the-tools-techniques-mechanisms-and-personnel-used-to-condu
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

This requirement addresses security-related issues with maintenance tools that are not within the organizational system boundaries that process, store, or transmit CUI, but are used specifically for diagnostic and repair actions on those systems. Organizations have flexibility in determining the controls in place for maintenance tools, but can include approving, controlling, and monitoring the use of such tools. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and into organizational systems. Maintenance tools can include hardware, software, and firmware items, for example, hardware and software diagnostic test equipment and hardware and software packet sniffers.

  

**Priority**: Medium

  

**Category**: Maintenance 

  

**Services Associated with AWS:**   

-   AWS Systems Manager, AWS Config

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how IT Asset Management (ITAM) is implemented
-   Administrative: supporting documentation to demonstrate change management practices reviewed/approved the maintenance request(s)
-   Administrative: supporting documentation of a Vulnerability & Patch Management Program (VPMP) that addresses preventative maintenance operations
-   Administrative: supporting documentation of role-based security training being performed
-   Administrative: supporting documentation of professional competence by individual(s) performing maintenance roles
-   Technical: screenshot of Configuration Management Database (CMDB) ticket  

  

Possible Technology Considerations : 

-   Identity & Access Management (IAM)
-   Change Control Solution
-   Configuration Management Database (CMDB)
-   IT Asset Management (ITAM)
-   Patch Management Solution 

  

**What needs to be answered :**  

  

Are controls in place that limit the tools, techniques, mechanisms, and employees used to maintain information systems, devices, and supporting systems? 

-   Controls on System Maintenance Tools  
    Description: This check ensures that organizations have implemented controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. These controls are designed to mitigate the potential security risks associated with maintenance tools, which are used for diagnostic and repair actions on organizational systems. The controls may include approval, control, and monitoring of the use of maintenance tools to prevent the introduction of malicious code or unauthorized access. 

  

**More Details:**   

Maintenance controls are restricted to IT support staff.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.