MA.L2-3.7.6: Supervise Maintenance Personnel Without Required Access
Maintenance activities pose unique security risks when personnel lack proper authorization. CMMC 2.0 control MA.L2-3.7.6 requires organizations to supervise maintenance work to prevent unauthorized access to systems and data. Implementing effective supervision controls protects your CUI while maintaining operational continuity.
What this means
This control mandates that organizations supervise maintenance personnel who do not possess the required access authorizations to perform their assigned work. Supervision ensures that individuals performing maintenance tasks cannot independently access systems, data, or facilities beyond what is necessary for their specific maintenance function. The goal is to prevent unauthorized disclosure, modification, or disruption of critical systems while allowing essential maintenance to occur.
How to comply
- 1.Identify all maintenance personnel and classify them by access level and authorization status
- 2.Document which maintenance activities require direct or indirect supervision
- 3.Assign qualified supervisory personnel to observe maintenance work when required
- 4.Create a supervision schedule that covers all maintenance tasks performed by non-authorized personnel
- 5.Establish clear supervision protocols including sign-in/sign-out procedures and activity logging
- 6.Train supervisors on security requirements and how to detect unauthorized access attempts
- 7.Review and update supervision requirements whenever maintenance roles or system access changes
- 8.Maintain audit records of all supervised maintenance activities with dates, times, and supervisors
Evidence auditors look for
- Maintenance personnel access control list showing authorization levels
- Supervision assignment schedule or staffing plan
- Signed maintenance supervision logs with supervisor and technician names
- Training records for supervisory personnel on security protocols
- System access logs showing maintenance activities and associated supervisors
- Maintenance work orders documenting supervision requirements
- Video surveillance or access badge records during maintenance windows
- Post-maintenance system audit trails confirming authorized actions only
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates maintenance personnel supervision tracking by centralizing access authorizations, generating supervision schedules, and logging all supervised activities in one audit-ready dashboard—eliminating manual spreadsheets and supervision gaps.
See how GRCWatch handles this control automatically
Start free trial