# NIST800 171 3.7.4 — Maintenance Tools

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist800171_374_d7186876d5-nist800-171-374-maintenance-tools
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST SP 800-171 Readiness](https://support.icompaas.com/support/solutions/c_gen_nist800171) › [Maintenance](https://support.icompaas.com/support/solutions/folders/f_gen_cgennist800171_maintenance)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 171 · Control 3.7.4 · Priority: high · Component: Maintenance

### What this control covers

This control ensures that the use of system Maintenance tools is approved, controlled, and monitored. It requires checking diagnostic and test media for malicious code before use and prevents the removal of Maintenance equipment containing Controlled Unclassified Information (CUI) by sanitizing or retaining it within the facility. This control supports the Maintenance Tool Management capability within the Maintenance (3.7) family.

### Why it matters

Peer review and automated testing catch the security defects single contributors miss; they also produce the audit evidence that controls are operating.

### How to implement

#### AWS

Use **CodeBuild** with [VPC-isolated](https://aws.amazon.com/codebuild/) build environments and **CodeArtifact** for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with **AWS Signer**.

#### Azure

Use **Azure DevOps Pipelines** with mandatory approvals on production environments and **Microsoft Defender for DevOps** for secret scanning across GitHub/ADO/GitLab in one pane.

#### GitHub

Apply **branch protection** on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use **CODEOWNERS** for required reviewers, **Dependabot** + **CodeQL** for SAST, and the **Dependency graph / SBOM** export for vendor disclosures.

### Evidence to collect

-   `code_repo_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Source control pipelines (GitHub, GitLab) enforce SDLC guardrails. Focus: Maintenance Tools.

### Quick checklist

-   Information — Management / Cui
-   System — Management / Cui
-   Maintenance — Management / Cui
-   Media — Management / Cui
-   Physical — Management / Cui
-   Security — Management / Cui

### Related articles on this site

-   [NIST 800-171 3.7.4 Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.](https://support.icompaas.com/support/solutions/articles/62000229307-nist-800-171-3-7-4-check-media-containing-diagnostic-and-test-programs-for-malicious-code-before-the-)
-   [NIST 800-171 3.7.2 Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.](https://support.icompaas.com/support/solutions/articles/62000229305-nist-800-171-3-7-2-provide-controls-on-the-tools-techniques-mechanisms-and-personnel-used-to-condu)
-   [NIST 800-171 3.8.1 Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.](https://support.icompaas.com/support/solutions/articles/62000229310-nist-800-171-3-8-1-protect-i-e-physically-control-and-securely-store-system-media-containing-cui-)
-   [NIST 800-171 3.8.3 Sanitize or destroy system media containing CUI before disposal or release for reuse.](https://support.icompaas.com/support/solutions/articles/62000229312-nist-800-171-3-8-3-sanitize-or-destroy-system-media-containing-cui-before-disposal-or-release-for-reu)

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.