NIST 800-171 R3 03.07.05 Nonlocal Maintenance at a Glance
- Family: 03.07 Maintenance (MA)
- Requirement ID: 03.07.05 Nonlocal Maintenance
- Assessment Objectives (AOs): Six (6) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Control: MA-04
- NIST 800-171 R3 Kill Chain Phase: Phase 14, Proactive Maintenance
Nonlocal Maintenance governs maintenance and diagnostic activity performed over a network rather than in person. Maintenance Tools (03.07.04) covers the tools, and Nonlocal Maintenance (03.07.05) covers the remote sessions that maintenance personnel use to reach the system. It has three (3) parts: approve and monitor nonlocal maintenance and diagnostic activities, implement multi-factor authentication (MFA) and replay resistance when establishing nonlocal maintenance and diagnostic sessions, and terminate the session and network connections when the maintenance is complete. Per the NIST discussion, nonlocal activities are conducted by individuals communicating over an external or internal network, while local activities are performed by someone physically present, and the authentication techniques reflect the requirements in 03.05.01.
A common difficulty with this requirement is treating remote vendor maintenance as ordinary remote access. It is a controlled activity that must be approved and monitored, protected with MFA and replay resistance, and torn down cleanly afterward. R3 adds the replay-resistance requirement and the explicit approve-and-monitor expectation, and it extends the concern from external network connections to internal ones as well.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.07.05 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.07.05 Nonlocal Maintenance. Only the formatting has been adjusted for readability. This requirement has three (3) lettered parts:
- a. Approve and monitor nonlocal maintenance and diagnostic activities.
- b. Implement multi-factor authentication and replay resistance in the establishment of nonlocal maintenance and diagnostic sessions.
- c. Terminate session and network connections when nonlocal maintenance is completed.
The source control is MA-04 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, nonlocal maintenance is conducted by individuals communicating over an external or internal network, and the authentication techniques used to establish nonlocal sessions reflect the requirements in User Identification, Authentication, and Re-Authentication (03.05.01). You can read the requirement directly at NIST 800-171 R3, 03.07.05 (p. 43).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.07.05?
None (0). Requirement 03.07.05 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.07.05 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.07.05?
NIST 800-171A R3 breaks 03.07.05 into six (6) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.07.05.a[01]: nonlocal maintenance and diagnostic activities are approved.
- A.03.07.05.a[02]: nonlocal maintenance and diagnostic activities are monitored.
- A.03.07.05.b[01]: multi-factor authentication is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
- A.03.07.05.b[02]: replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
- A.03.07.05.c[01]: session connections are terminated when nonlocal maintenance is completed.
- A.03.07.05.c[02]: network connections are terminated when nonlocal maintenance is completed.
Each part splits into its testable pieces: approve and monitor, MFA and replay resistance, and session and network connection termination. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.07.05 (p. 55).
Assessment Methods and Objects for NIST 800-171 R3 03.07.05
Examine: maintenance policy and procedures; remote access policy and procedures; procedures for nonlocal system maintenance; records of remote access; maintenance records; diagnostic records; system design documentation; system configuration settings; system security plan.
Interview: personnel with system maintenance responsibilities; personnel with information security responsibilities; system administrators.
Test: processes for managing nonlocal maintenance; mechanisms for implementing, supporting, or managing nonlocal maintenance; mechanisms for implementing multi-factor authentication and replay resistance; mechanisms for terminating nonlocal maintenance sessions and network connections.
How Does NIST 800-171 R3 03.07.05 Map From NIST 800-171 R2?
03.07.05 maps from NIST 800-171 R2 requirement 3.7.5 (require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete):
- A.03.07.05.b[01] maps directly to R2 3.7.5[a] (MFA is required to establish nonlocal maintenance sessions).
- A.03.07.05.c[01] and A.03.07.05.c[02] map directly to R2 3.7.5[b] (nonlocal sessions are terminated when maintenance is complete).
- A.03.07.05.b[02] is net new for R3.
- A.03.07.05.a[01] and A.03.07.05.a[02] have no clear mapping to any R2 assessment objective.
Mapped against the six (6) AOs, three (3) are direct (minimal effort), one (1) is net new, and two (2) have no clear mapping, with the last two (2) categories both counting as significant effort. MFA and session termination carry forward, but replay resistance is new, and the explicit approve-and-monitor objectives do not trace cleanly to a R2 objective. R3 also broadens the concern from external network connections to internal ones. Three of the six (6) objectives are significant effort.
How Does NIST 800-171 R3 03.07.05 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.07.05 through the following SCF controls:
- CHG-03 Configuration Change Control
- CHG-04 Prohibition Of Changes
- CFG-04 Secure Baseline Configurations
- CFG-04.5 Session Termination
- IAC-03 Authenticate, Authorize and Audit (AAA)
- IAC-03.1 Replay-Resistant Authentication
- IAC-36.2 Privileged Access by Non-Organizational Users
- IAC-37 Multi-Factor Authentication (MFA)
- IAC-37.1 Replay-Resistant Multi-Factor Authentication (MFA)
- MNT-03 Controlled Maintenance
- MNT-12 Remote Maintenance
- MNT-12.2 Remote Maintenance Pre-Approval
- MNT-12.3 Remote Maintenance Disconnect Verification
- MNT-12.4 Remote Maintenance Cryptographic Protection
- MNT-12.5 Auditing Remote Maintenance
- NET-28 Network Connection Termination
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.07.05
The following are issues teams may encounter rather than certainties. They are about the new controls and clean teardown, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Replay resistance is net new. A.03.07.05.b[02] requires replay-resistant authentication for nonlocal maintenance sessions, in addition to MFA. Solve it with the same replay-resistant authenticators used for 03.05.04.
- Approve and monitor is required. A.03.07.05.a[01] and a[02] have no clear R2 predecessor. Vendor remote sessions must be approved and monitored, not left as standing access.
- Terminate both session and network connections. A.03.07.05.c[01] and c[02] are separate objectives. Ending the maintenance session without dropping the network connection leaves an objective open.
- Internal networks count too. Per the NIST discussion, nonlocal activity can occur over an external or internal network, so do not scope this only to internet-based vendor access.
What Is Reasonable Evidence For NIST 800-171 R3 03.07.05?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.07.05 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.07.05 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-12 Secure Baseline Configurations Reviews. A review process to ensure secure baseline configurations (sbc) are current and applicable (e.g., system configuration settings and associated documentation).
- E-AST-13 Secure Baseline Configurations - Cloud-Based Services. Secure baseline configurations for all deployed types of cloud-based services or applications.
- E-AST-14 Secure Baseline Configurations - Databases. Secure baseline configurations for all deployed types of databases.
- E-AST-15 Secure Baseline Configurations - Embedded Technologies. Secure baseline configurations for all deployed types of embedded technologies.
- E-AST-16 Secure Baseline Configurations - Major Applications. Secure baseline configurations for all deployed types of major applications.
- E-AST-17 Secure Baseline Configurations - Minor Applications. Secure baseline configurations for all deployed types of minor applications.
- E-AST-18 Secure Baseline Configurations - Mobile Devices. Secure baseline configurations for all deployed types of mobile devices.
- E-AST-19 Secure Baseline Configurations - Network Devices. Secure baseline configurations for all deployed types of network devices.
- E-AST-20 Secure Baseline Configurations - Server Class Systems. Secure baseline configurations for all deployed types of server-class operating systems.
- E-AST-21 Secure Baseline Configurations - Workstation Class Systems. Secure baseline configurations for all deployed types of workstation-class operating systems.
- E-CHG-02 Charter - Change Control Board (CCB). The organization's change control board (ccb) charter and mission to govern the organization's change control processes.
- E-CHG-03 Change Control Board (CCB) Minutes. Change control board (ccb) meeting minutes.
- E-CHG-05 Change Control Records. Change control records (including test results, when applicable).
- E-IAC-06 Authenticate, Authorize and Audit (AAA) Solution. An authenticate, authorize and audit (aaa) solution (on-premises and hosted by external service providers (esp)).
- E-IAC-16 Multi-Factor Authentication (MFA) Configuration. Multi-factor authentication (mfa) enforcement, including replay-resistant and phishing-resistant authenticators for privileged and non-privileged network access.
- E-MNT-04 Maintenance Activities. Maintenance activities for the organization's technology assets, applications and/or services (taas).
- E-MNT-06 Remote Maintenance Records. Remote maintenance sessions, including pre-approval, notification, cryptographic protection, disconnect verification and audit records.
- E-VPM-07 Flaw Remediation Change Control. Installation/change control records for security-relevant software and firmware updates.
Alongside these, keep the System Security Plan (SSP) narrative for 03.07.05.
Timeline Considerations for NIST 800-171 R3 03.07.05
With three (3) AOs mapping directly, one net new, and two with no clear mapping, 03.07.05 is a moderate lift. A realistic sequence:
- Establish approval and monitoring for nonlocal maintenance and diagnostic activities (A.03.07.05.a[01] and a[02]).
- Require MFA and replay resistance to establish nonlocal sessions (A.03.07.05.b[01] and b[02]), coordinating with 03.05.03 and 03.05.04.
- Terminate both the session and the network connection when maintenance completes (A.03.07.05.c[01] and c[02]).
- Collect evidence for all six (6) AOs, including approvals, monitoring records, authentication configuration, and teardown evidence.
Frequently Asked Questions About NIST 800-171 R3 03.07.05
How many assessment objectives does NIST 800-171 R3 03.07.05 have? NIST 800-171A R3 breaks 03.07.05 into six (6) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.07.05 come from? MA-04.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.07.05 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.07.05 sit in the NIST 800-171 R3 Kill Chain? Phase 14, Proactive Maintenance. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.07.05
03.07.05 Nonlocal Maintenance approves and monitors remote maintenance, protects the sessions with multi-factor authentication and replay resistance, and terminates the session and network connections when done. It maps from R2 3.7.5 with MFA and termination transitioning directly, while replay resistance is net new and the approve-and-monitor objectives have no clear R2 mapping. The recurring problem is treating vendor remote maintenance as ordinary remote access. Approve and monitor it, require MFA and replay resistance, and tear down the connection cleanly.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
