- Keep an approved-tools list and treat unlisted maintenance software and hardware as exceptions needing sign-off.
- Scan diagnostic media on a standalone station before it touches production systems — in OT environments, vendor USB media is a documented infection vector.
- Before any maintenance device leaves the facility, decide its CUI status deliberately: verify it is clean, sanitize it, or keep it on site.
03.07.04OFFICIAL TITLEPENDING NIST SME REVIEW
03.07.04 — Maintenance Tools
03.07 Maintenance · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires approving, controlling, and monitoring the use of system maintenance tools; checking media containing diagnostic and test programs for malicious code before use; and preventing the removal of maintenance equipment containing CUI by verifying no CUI is present, sanitizing or destroying the equipment, or retaining it within the facility.
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Maintenance tooling is a classic bypass path: the technician's laptop, the USB stick of diagnostics, and the vendor's calibration rig all touch systems with elevated reach while sitting outside normal management. This requirement puts approval, malware checking, and CUI-aware exit handling around the toolkit itself.
Across revisions
Consolidates three Rev. 2 requirements — maintenance tool controls (3.7.2), off-site equipment sanitization (3.7.3), and diagnostic-media malware checks (3.7.4) — into one Maintenance Tools requirement. Rev. 2's general perform-maintenance requirement (3.7.1) was not carried forward as a security requirement.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The approved maintenance tools list with approval records
- Malware-check records for diagnostic and test media
- Sanitization or retention decisions for equipment leaving the facility
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |