Maintenance Tools addresses the security risks that come from the tools used to diagnose and repair systems. It is part of the Maintenance (03.07) family, and it recognizes that diagnostic and test tools, whether pre-installed, brought in on media, cloud-based, or downloaded, can carry malicious code into a system or carry Controlled Unclassified Information (CUI) out of it. Maintenance Tools (03.07.04) has three (3) parts: approve, control, and monitor the use of system maintenance tools, check media containing diagnostic and test programs for malicious code before use, and prevent maintenance equipment that contains CUI from leaving the facility unless the CUI is removed, the equipment is sanitized or destroyed, or the equipment is retained. Per the NIST discussion, maintenance tools can include hardware and software diagnostic equipment and packet sniffers, and media inspection can include checking cryptographic hashes or digital signatures.
A common difficulty with this requirement is treating maintenance tooling as outside the security program. R3 makes it explicit: tools are approved, controlled, and monitored, media is scanned before use, and equipment carrying CUI cannot simply walk out the door for off-site repair. The monitoring of tools and the CUI-equipment removal controls are the newer parts.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.07.04 Maintenance Tools. Only the formatting has been adjusted for readability. This requirement has three (3) lettered parts:
The source controls are MA-03, MA-03(01), MA-03(02), and MA-03(03) from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, if inspected media are found to contain malicious code, the incident is handled per incident handling procedures, and a periodic review of maintenance tools can lead to withdrawing approval for outdated or unused tools. You can read the requirement directly at NIST 800-171 R3, 03.07.04 (p. 42).
None (0). Requirement 03.07.04 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.07.04 therefore records how the requirement is implemented rather than a parameter you chose.
NIST 800-171A R3 breaks 03.07.04 into five (5) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
Part a splits into approve, control, and monitor as separate objectives. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.07.04 (p. 54).
Examine: maintenance policy and procedures; procedures for system maintenance tools; system maintenance tools; maintenance tool inspection records; equipment sanitization records; media sanitization records; system security plan.
Interview: personnel with system maintenance responsibilities; personnel responsible for media sanitization; personnel with information security responsibilities.
Test: processes for approving, controlling, and monitoring maintenance tools; mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools; processes for preventing the unauthorized removal of information; processes for inspecting media for malicious code; mechanisms for supporting media sanitization or the destruction of equipment; mechanisms for supporting the verification of media sanitization; processes for inspecting maintenance tools; mechanisms for supporting or implementing the inspection of maintenance tools; mechanisms for supporting or implementing the inspection of media used for maintenance.
03.07.04 maps from NIST 800-171 R2 requirement 3.7.2 (provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance), and it draws on R2 requirement 3.7.4 (check media containing diagnostic and test programs for malicious code before the media are used):
Mapped against the five (5) AOs, two (2) are direct (minimal effort), one (1) is indirect (moderate effort), and two (2) are net new (significant effort), with none having no mapping. Controlling tools and checking media carry forward, but monitoring tool use and preventing the removal of CUI-bearing maintenance equipment are new. Two of the five (5) objectives are significant effort.
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.07.04 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about the new monitoring and CUI-equipment controls, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.07.04 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.07.04 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.07.04.
With two (2) AOs mapping directly, one indirectly, and two net new, 03.07.04 is a moderate lift. A realistic sequence:
How many assessment objectives does NIST 800-171 R3 03.07.04 have? NIST 800-171A R3 breaks 03.07.04 into five (5) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.07.04 come from? MA-03, MA-03(01), MA-03(02), MA-03(03).
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.07.04 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.07.04 sit in the NIST 800-171 R3 Kill Chain? Phase 14, Proactive Maintenance. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.07.04 Maintenance Tools approves, controls, and monitors maintenance tools, scans diagnostic media for malicious code, and prevents CUI-bearing maintenance equipment from leaving the facility uncontrolled. It maps from R2 3.7.2 and 3.7.4, with tool control and media checking transitioning directly, while tool monitoring and the CUI-equipment control are net new. The recurring problem is treating maintenance tooling as outside the security program. Approve, control, and monitor the tools, scan media before use, and control removal of equipment containing CUI.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
