MA.2.112 — Provide controls on tools and personnel for maintenance

CMMC Level 2SPRS if unmet: -3HIGH priority~6h to implement

Provide controls on the tools, techniques, mechanisms, and personnel that perform maintenance on organizational systems.

What MA.2.112 means in plain English

When someone comes to fix or maintain your computers — whether that is your MSP (managed service provider), a vendor technician, or an employee — you need controls over what they do and what tools they use. You must approve who can do maintenance, what tools they are allowed to use (no unauthorized software), and what they are allowed to access. This means: your MSP should have a signed agreement listing what systems they can access, you should be present or have a log of remote sessions, and unauthorized tools (like a personal USB drive with unknown software) should not be used on your systems.

The assessment question

“Are maintenance personnel vetted and authorized before performing maintenance — and are maintenance tools and activities controlled, logged, and reviewed to prevent unauthorized access or installation of software?”

How to implement MA.2.112

Establish a list of authorized maintenance personnel and contractors — include name, company, contact info, and systems they are authorized to access.
Require all third-party maintenance providers to sign a Maintenance Access Agreement specifying: no unauthorized software installation, all actions must be logged, no data copying without written approval, and immediate notification of any issues discovered.
When your MSP performs remote maintenance, require them to use a remote access tool that logs session recordings (many RMM tools like ConnectWise or Datto do this automatically).
Restrict maintenance tool usage: only allow your approved IT tools (from a defined software whitelist) on company systems; prevent installation of unknown utilities.
After any maintenance session, review the activity log and have the technician sign off on a Maintenance Record form confirming what was done.

Evidence your assessor will ask for

Authorized Maintenance Personnel List with signatures
Signed Maintenance Access Agreements from all third-party providers
Sample remote access session log showing technician activity was recorded
Maintenance Records for the past 12 months with technician sign-offs
Software whitelist policy for approved maintenance tools

Does AI prompt monitoring help with this control? Honestly, no.

MA.2.112 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Maintenance controls

MA.2.111

Perform maintenance on organizational systems

MA.2.113

Ensure equipment removed for offsite maintenance is sanitized

MA.2.114

Check media containing diagnostic programs for malicious code

MA.2.115

Require multifactor authentication for nonlocal maintenance

MA.2.116

Supervise maintenance activities without required access authorization

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment