3.7.1 — Maintain on Schedule
What It Says
Section titled “What It Says”Perform maintenance on organizational systems.
What It Actually Means
Section titled “What It Actually Means”Regular, scheduled maintenance on all CUI systems — documented. This covers four types: corrective (fixing problems), preventive (updates to prevent problems), adaptive (changes for new requirements), and perfective (performance improvements). For most DIB contractors, the core of maintenance is patching (covered in detail by 3.14.1) and hardware servicing.
The assessor checks that maintenance is performed on a defined schedule and that records exist. “We patch when we remember to” is not a maintenance program.
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Is system maintenance performed? | Maintenance schedule exists; records of completed maintenance with dates, systems, and work performed |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: System maintenance policy; maintenance schedule; maintenance records; vendor maintenance specifications; system security plan
People they’ll talk to: Personnel with maintenance responsibilities; information security personnel; system or network administrators
Live demos they’ll ask for: “Show me your maintenance schedule.” “Show me records from the last three months.” “How do you track what was done?”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”- “Show me your maintenance schedule. Is it defined or ad-hoc?”
- “Show me records of maintenance performed in the last quarter.”
- “Are all system types covered — servers, workstations, network devices, firmware?”
- “How do you document what maintenance was performed?”
Where Companies Trip Up
Section titled “Where Companies Trip Up”No schedule. Maintenance happens reactively when something breaks. Define a schedule — monthly patching at minimum.
No records. Patches applied but nothing documented. Use your patching tool’s compliance reports and supplement with maintenance tickets.
Incomplete coverage. Servers patched but workstations, network devices, and firmware neglected. All CUI system types require maintenance.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.14.1 — Patch Your Systems | Patching is the primary maintenance activity for most systems |
| 3.4.3 — Control Every Change | Maintenance activities are changes that go through change management |
| 3.7.5 — MFA for Remote Maintenance | Remote maintenance requires MFA |
Implementation
Section titled “Implementation”Step-by-step guides for Microsoft 365, AWS, Azure, and GCP are available to Ancitus clients.
Start a conversation →CMMC Practice ID: MA.L2-3.7.1 | SPRS Weight: 3 points | POA&M Eligible: No