What this control covers
This control ensures that the use of system Maintenance tools is approved, controlled, and monitored. It requires checking diagnostic and test media for malicious code before use and prevents the removal of Maintenance equipment containing Controlled Unclassified Information (CUI) by sanitizing or retaining it within the facility. This control supports the Maintenance Tool Management capability within the Maintenance (3.7) family.
Why it matters
Peer review and automated testing catch the security defects single contributors miss; they also produce the audit evidence that controls are operating.
How to implement
AWS
Use CodeBuild with VPC-isolated build environments and CodeArtifact for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with AWS Signer.
Azure
Use Azure DevOps Pipelines with mandatory approvals on production environments and Microsoft Defender for DevOps for secret scanning across GitHub/ADO/GitLab in one pane.
GitHub
Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.
Evidence to collect
code_repo_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Maintenance Tools.
Quick checklist
- Information — Management / Cui
- System — Management / Cui
- Maintenance — Management / Cui
- Media — Management / Cui
- Physical — Management / Cui
- Security — Management / Cui
Related articles on this site
- NIST 800-171 3.7.4 Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
- NIST 800-171 3.7.2 Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
- NIST 800-171 3.8.1 Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
- NIST 800-171 3.8.3 Sanitize or destroy system media containing CUI before disposal or release for reuse.