NIST 800-171 R3 03.07.06 Maintenance Personnel at a Glance
- Family: 03.07 Maintenance (MA)
- Requirement ID: 03.07.06 Maintenance Personnel
- Assessment Objectives (AOs): Five (5) determination statements
- Organization-Defined Parameters (ODPs): None (0). This requirement contains no organization-defined values
- Source NIST 800-53 R5 Control: MA-05
- NIST 800-171 R3 Kill Chain Phase: Phase 14, Proactive Maintenance
Maintenance Personnel controls who is allowed to perform maintenance on the system and how people without the right authorizations are supervised. It completes the Maintenance (03.07) family, which also covers the tools (03.07.04) and remote sessions (03.07.05). Maintenance Personnel (03.07.06) has four (4) parts: establish a process for authorizing maintenance personnel, maintain a list of authorized maintenance organizations or personnel, verify that non-escorted maintenance personnel have the required access authorizations, and designate qualified staff to supervise maintenance performed by personnel who lack those authorizations. Per the NIST discussion, this addresses individuals who perform hardware or software maintenance, and organizations may issue temporary credentials to previously unidentified maintenance personnel, such as vendors or consultants, based on their risk assessments.
A common difficulty with this requirement is letting vendors and contractors perform maintenance without a defined authorization process or supervision. The classic gap is an unescorted third-party technician who does not hold the required access authorizations working on the system without a qualified supervisor. R3 makes the authorization process, the personnel list, and the supervision arrangement all explicit and assessable.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
- The National Institute of Standards and Technology (NIST) withdrew R2 on May 14, 2024, the same day R3 was published. The withdrawal notice states that R2 "has been withdrawn (archived), and is provided solely for historical purposes," so it will never receive another correction or clarification from NIST.
- R2 remains the contractual standard for the Department of Defense (DoD) and the Defense Industrial Base (DIB). Cybersecurity Maturity Model Certification (CMMC) assessments reference it directly: per Title 32 of the Code of Federal Regulations (CFR), section 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."
- The rulemaking points the other direction. The proposed Controlled Unclassified Information (CUI) rule for the Federal Acquisition Regulation (FAR), published June 23, 2026 as part of the Revolutionary FAR Overhaul, would apply CUI safeguarding requirements government wide rather than only to DoD contracts, and it sets the baseline at R3. That rule is not final, and DoD has separately signaled an interim rule to move CMMC to R3.
What Does NIST 800-171 R3 03.07.06 Actually Require?
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.07.06 Maintenance Personnel. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts:
- a. Establish a process for maintenance personnel authorization.
- b. Maintain a list of authorized maintenance organizations or personnel.
- c. Verify that non-escorted personnel who perform maintenance on the system possess the required access authorizations.
- d. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
The source control is MA-05 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, this requirement addresses maintenance personnel while physical access for individuals whose duties place them within the physical protection perimeter is addressed by Physical Access Authorizations (03.10.01), and temporary credentials may be issued for one-time use or very limited periods. You can read the requirement directly at NIST 800-171 R3, 03.07.06 (p. 43).
What Are the Organization-Defined Parameters (ODPs) Associated with NIST 800-171 R3 03.07.06?
None (0). Requirement 03.07.06 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.07.06 therefore records how the requirement is implemented rather than a parameter you chose.
What Are the Assessment Objectives (AOs) For NIST 800-171 R3 03.07.06?
NIST 800-171A R3 breaks 03.07.06 into five (5) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
- A.03.07.06.a: a process for maintenance personnel authorization is established.
- A.03.07.06.b: a list of authorized maintenance organizations or personnel is maintained.
- A.03.07.06.c: non-escorted personnel who perform maintenance on the system possess the required access authorizations.
- A.03.07.06.d[01]: organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
- A.03.07.06.d[02]: organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Part d splits into supervisors with the required access authorizations and supervisors with the required technical competence, so a supervisor must have both. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.07.06 (p. 56).
Assessment Methods and Objects for NIST 800-171 R3 03.07.06
Examine: maintenance policy and procedures; service provider contracts; service-level agreements; list of authorized personnel; maintenance records; access control records; system security plan.
Interview: personnel with system maintenance responsibilities; personnel with information security responsibilities.
Test: processes for authorizing and managing maintenance personnel; mechanisms for supporting or implementing the authorization of maintenance personnel.
How Does NIST 800-171 R3 03.07.06 Map From NIST 800-171 R2?
03.07.06 maps from NIST 800-171 R2 requirement 3.7.2 (provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance), and it absorbs R2 requirement 3.7.6 (supervise the maintenance activities of maintenance personnel without required access authorization):
- A.03.07.06.a, A.03.07.06.b, and A.03.07.06.c map indirectly to elements of R2 3.7.2[d] (personnel used to conduct maintenance are controlled).
- A.03.07.06.d[01] and A.03.07.06.d[02] map indirectly to elements of R2 3.7.6 (unauthorized maintenance personnel are supervised).
Mapped against the five (5) AOs, all five (5) are indirect (moderate effort), with no net-new AOs and none with no mapping. The personnel controls and supervision carry forward, but R3 restructures them into an explicit authorization process, a maintained list, a verification of non-escorted personnel, and a two-part supervision requirement. Confirm your maintenance authorization is documented rather than assuming your R2 personnel controls fully cover the new structure.
How Does NIST 800-171 R3 03.07.06 Map to NIST 800-53 R5 and the SCF?
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.07.06 through the following SCF controls:
- HRS-03.2 Competency Requirements for Security, Compliance & Resilience-Related Positions
- HRS-04 Defined Roles & Responsibilities
- IAC-06 Role-Based Access Control (RBAC)
- MNT-02 Maintenance Operations
- MNT-14 Authorized Maintenance Personnel
- MNT-14.1 Maintenance Personnel Without Appropriate Access
- MNT-15 Non-System Related Maintenance
- TPM-02 Third-Party Management
- TPM-08 Third-Party Inventories
- TPM-11 Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix
- TPM-14 Third-Party Contract Requirements
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
Common Pitfalls with NIST 800-171 R3 03.07.06
The following are issues teams may encounter rather than certainties. They are about the authorization process and supervision, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
- Maintain the authorized list. A.03.07.06.b requires a current list of authorized maintenance organizations or personnel. An informal understanding of who is allowed does not satisfy this objective.
- Supervisors need both authorization and competence. A.03.07.06.d[01] and d[02] require supervisors who hold the required access authorizations and the technical competence. One without the other is a gap.
- Non-escorted personnel must be authorized. A.03.07.06.c requires that unescorted maintenance personnel possess the required access authorizations. Escorting is the alternative for those who do not.
- Coordinate with physical access. Per the NIST discussion, physical access for maintenance individuals is handled by 03.10.01, so keep the two aligned.
What Is Reasonable Evidence For NIST 800-171 R3 03.07.06?
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.07.06 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.07.06 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
- E-AST-06 Asset Inventories - Cloud Service Provider (CSP). An inventory of the organization's cloud-based services (e.g., saas, iaas, paas, etc.).
- E-CPL-03 Shared Responsibility Matrix (SRM) / Controls Responsibility Matrix (CRM). A controls responsibility matrix (crm), or similar documentation, that identifies the stakeholder involved in executing assigned controls (e.g., responsible, accountable, supportive, consulted & informed (rasci) matrix).
- E-DCH-06 Third-Party Inventories. An inventory of external service providers (esp), contractors, vendors, etc. that directly or indirectly impact the organization's technology assets, applications, services and/or data (taasd).
- E-HRS-02 Assigned Roles - Application Developers. List of employed or contract personnel assigned to application development roles.
- E-HRS-03 Assigned Roles - Cybersecurity Staff. List of employed or contract personnel assigned to cybersecurity roles.
- E-HRS-04 Assigned Roles - Data Privacy Staff. List of employed or contract personnel assigned to data privacy roles.
- E-HRS-13 Defined Cybersecurity & Data Privacy Responsibilities. A role-based cybersecurity & data privacy responsibilities to ensure personnel are both educated on the role and are responsible for the associated control execution.
- E-HRS-14 Responsibilities Review. A formal review process to ensure assigned responsibilities currently reflect business needs for the assigned role.
- E-HRS-21 Position Competency Requirements. Personnel management practices to define minimum competency requirements for cybersecurity & data privacy-related roles.
- E-HRS-23 Critical Cybersecurity & Data Privacy Skills. Personnel management practices to formally identify critical cybersecurity skills needed to support business operations.
- E-IAC-02 Defined Roles & Authorizations (RBAC). Defined access control-specific roles (e.g., role based access control (rbac)) that affect both logical and physical access authorizations.
- E-MNT-01 Maintenance - Authorized Maintenance Personnel. Personnel who have designated maintenance roles.
- E-MNT-02 Maintenance Plan. A maintenance plan. this is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-RSK-02 Supply Chain Risk Management (SCRM) Plan. A supply chain risk management (scrm) plan. this is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards.
- E-TPM-01 Third-Party Contracts. Third-party contractual obligations for cybersecurity & data privacy protections.
- E-TPM-06 Third-Party Terms & Conditions. Terms and conditions for external systems.
- E-TPM-07 System Connection or Processing Agreements. System connection or processing agreements.
Alongside these, keep the System Security Plan (SSP) narrative for 03.07.06.
Timeline Considerations for NIST 800-171 R3 03.07.06
With all five (5) AOs mapping indirectly, 03.07.06 is a moderate lift centered on documentation and supervision. A realistic sequence:
- Establish and document the maintenance personnel authorization process (A.03.07.06.a).
- Build and maintain the list of authorized maintenance organizations or personnel (A.03.07.06.b).
- Verify non-escorted maintenance personnel hold the required access authorizations, and escort those who do not (A.03.07.06.c).
- Designate supervisors with both the required access authorizations and technical competence (A.03.07.06.d[01] and d[02]).
- Collect evidence for all five (5) AOs, including the process, the authorized list, and supervision records.
Frequently Asked Questions About NIST 800-171 R3 03.07.06
How many assessment objectives does NIST 800-171 R3 03.07.06 have? NIST 800-171A R3 breaks 03.07.06 into five (5) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.07.06 come from? MA-05.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.07.06 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.07.06 sit in the NIST 800-171 R3 Kill Chain? Phase 14, Proactive Maintenance. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
Bottom Line on NIST 800-171 R3 03.07.06
03.07.06 Maintenance Personnel establishes an authorization process, maintains a list of authorized maintenance personnel, verifies non-escorted personnel are authorized, and supervises those who are not. It maps from R2 3.7.2 and absorbs 3.7.6, with all five (5) assessment objectives transitioning indirectly. The recurring problem is unsupervised third-party maintenance. Document the authorization process and list, verify non-escorted personnel, and supervise unauthorized personnel with staff who have both access and competence.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
