CMMC MA.L2-3.7.6 – Maintenance Personnel requires that maintenance personnel without required access authorization be supervised during maintenance…

A documented procedure for supervised maintenance should focus on the process and controls for the activity itself. It must define the scope of authorized actions for the maintenance personnel (B), provide emergency contacts for incident response (C), and detail how the supervision will be conducted and monitored (D). Including a detailed list of all CUI assets (A) is inappropriate for a procedural document. This information is an asset inventory, not a process step. Including it would create an unnecessary security risk by aggregating sensitive location information into a document that may have wider distribution than the asset inventory itself.

B. The specific steps authorized for the visiting maintenance personnel with limited access: This is essential for the procedure, as it defines the boundaries of the work and what the supervisor must enforce.

C. Contact information for the organization's IT security team in case of emergencies or unexpected issues: This is a critical component for any IT procedure, ensuring a clear path for incident escalation and response.

D. The method used to authenticate and monitor the supervisor's activity during the maintenance session: This ensures accountability and that the supervision itself is being performed correctly and can be audited if necessary.

---

1. NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Section 3.7.6, Page 21: The control states, "Supervise maintenance activities of personnel without required access authorization." The discussion notes emphasize controlling access, which is achieved through procedural steps, not by listing the data that requires protection within the procedure itself. The focus is on the actions of personnel.

2. CMMC Model Version 2.0, CMMC Level 2 Practices.

Practice MA.L2-3.7.6, Page 45: This practice is directly derived from NIST SP 800-171 3.7.6. The requirement is to supervise the activities. A procedure, therefore, must define the rules and steps for that supervision, not provide a data inventory.

3. NIST SP 800-171A, Assessing Security Requirements for CUI.

Section 3.7.6, Assessment Procedures, Page 68: The assessment objectives focus on determining if procedures for supervision are defined and if personnel are supervised. The potential assessment methods include examining "procedures addressing the supervision of maintenance personnel." This confirms the expected evidence is a document outlining a process, not an asset list.