# MA-03 Maintenance Tools

NIST SP 800-53 control. Family: MA Maintenance. Function: preventative. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: organization-defined frequency].
Guidance: Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping,""ls,""ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.

## Enhancements (6)
- MA-03(01) Inspect Tools. Baselines: moderate, high
- MA-03(02) Inspect Media. Baselines: moderate, high
- MA-03(03) Prevent Unauthorized Removal. Baselines: moderate, high
- MA-03(04) Restricted Tool Use
- MA-03(05) Execution with Privilege
- MA-03(06) Software Updates and Patches
Each enhancement's statement: /api/v1/controls/MA-03?fields=enhancements

## Patterns that use it (2)
- Standard (2): SP-001 Client Module; SP-002 Server Module

## Clauses by framework (24 frameworks)
- iso_27001_2022: A.7.13. OSA's own, not in NIST's crosswalk: A.7.13
- iso_27002_2022: 7.13
- cobit_2019: DSS01
- iso_42001_2023: A.4.4
- anssi: Hygiene.20, Hygiene.34, SecNumCloud.13.4
- osfi_b13: B-13.2.3
- finma_circular: IV.A(28), IV.A(29)
- gdpr: Art.32(1)(b)
- dora: Art.7(1), Art.9(4)(e)
- bio2: 7.13
- rbi_csf: Annex1.7
- fisc: FISC.F3
- mlps_2: 8.1.10.2
- dnb_good_practice: DNB.18.2
- cbe_csf: CTO-10
- cbn_csf: Part3.3
- bot_cyber: Ch10.1
- hipaa_sr: §164.310(a)(2)(iv)
- sebi_cscrf: PR.MA
- cmmc_2: MA
- nrc_73_54: RG5.71-B-MA
- pci_pts: K
- fca_sysc_13: SYSC 13.7.2
- solvency_ii: EIOPA-ICT-4.8
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/MA-03
- Clauses only: /api/v1/controls/MA-03?fields=mappings
- Page for people: /controls/ma-03/