MA.2.111 — Perform maintenance on organizational systems

CMMC Level 2SPRS if unmet: -3MEDIUM priority~4h to implement

Perform maintenance on organizational systems.

What MA.2.111 means in plain English

You need a documented, regular schedule for maintaining your computers, servers, and network equipment — not just fixing things when they break, but proactive maintenance. This includes applying security patches and Windows updates, replacing end-of-life hardware, and checking that backups are running correctly. For your 8-person team, this means setting Windows Update to auto-install patches, scheduling a monthly check on all systems, and keeping a maintenance log. Think of it like an oil change schedule for your cars — you do not wait until the engine seizes.

The assessment question

“Is system maintenance performed on a documented, recurring schedule — with maintenance activities logged including date, technician, system affected, and work performed?”

How to implement MA.2.111

Create a Maintenance Schedule document listing all systems (workstations, servers, network devices, printers) with their maintenance frequency: Windows Update monthly, antivirus definition verification weekly, hardware inspection annually.
Enable Windows Update Automatic Updates on all workstations and set to "Install automatically" — configure via Group Policy to force updates outside business hours.
Set up a Maintenance Log (spreadsheet or SharePoint list) with columns: Date, System Name, Maintenance Type, Performed By, Work Description, Issues Found, Resolution.
Schedule a recurring monthly calendar event (30 minutes) labeled "Monthly System Maintenance Review" — check update status, review logs, confirm backups ran successfully.
For any vendor or contractor who performs maintenance on your systems, require them to log their activities in your Maintenance Log immediately after completing work.

Evidence your assessor will ask for

Written Maintenance Schedule document listing all systems and maintenance frequencies
Maintenance Log showing entries for the past 12 months
Windows Update configuration screenshot showing automatic updates enabled
Evidence of recent patch compliance report (Intune compliance report or Windows Update history)

Does AI prompt monitoring help with this control? Honestly, no.

MA.2.111 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Maintenance controls

MA.2.112

Provide controls on tools and personnel for maintenance

MA.2.113

Ensure equipment removed for offsite maintenance is sanitized

MA.2.114

Check media containing diagnostic programs for malicious code

MA.2.115

Require multifactor authentication for nonlocal maintenance

MA.2.116

Supervise maintenance activities without required access authorization

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment

NIST 800-171 Controls · Maintenance