Maintenance tools are a vector. A compromised diagnostic tool or vendor device can introduce malware during routine maintenance. You need to know what tools touch your systems and verify they’re legitimate.
What the assessor is actually evaluating
The assessor is checking: (1) Do you know what tools are used for maintenance? (2) Do you verify they’re legitimate and not compromised? (3) Do you control access to them? This isn’t about having a sophisticated tool management system. It’s about being deliberate. You have a list. You verify. You control. This practice ties directly to MA.L2-3.7.1 (system maintenance scheduling) and works with MA.L2-3.7.4 (media inspection) to keep maintenance tooling secure.
For many small organizations, this is simple: vendor tools come with serial numbers you verify, internal tools are stored securely, and only authorized personnel use them.
What a realistic SSP definition looks like
All maintenance tools are maintained on an approved tools list. Tools are verified by model/serial number before use. Tools are obtained only from authorized vendors and scanned for malware before use on CUI systems. Tools are stored in a secure location with access limited to authorized maintenance staff.
Approved tools include: [vendor diagnostic tool, internal imaging tool, etc.]. Verification is documented in [maintenance log/tracking system].
How to present your evidence
- Approved maintenance tools list (model, serial number, vendor, purpose)
- Vendor documentation or receipts showing tool legitimacy
- Maintenance or maintenance log showing tools used and verification done
- Documentation of tool storage and access control
- If applicable, records of malware scans on tools before use
Common failures
No tools list. You use maintenance tools, but you don't have a formal list of what they are. You can't point to your approved tools. Create one.
No verification process. Tools arrive from the vendor or IT brings something in. You don't verify their authenticity or integrity. Add a verification step, even if simple.
You're good here. You maintain a list of approved tools (vendor, model, serial), verify them before use, and store them securely. Maintenance logs show verification completed. Assessors confirm this is adequate and move on.
If you use an MSP/MSSP
Many MSPs use standard diagnostic tools (Dell Diagnostics, HPE iLO, etc.). Get their list of tools and add it to your approved list. In your MSP contract, specify they must verify tools before use and you require tool manifests for each engagement. Track this in your maintenance log.
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Q&A: What the assessor asks
Q: “How do you verify them?" A: “We check serial numbers against vendor records and scan them for malware before they touch CUI systems.”
Q: “Where are they stored?" A: “In a locked cabinet in [location]. Only [role] has access.”
This guide reflects CMMC Level 2 requirements as of March 2026. CMMC and NIST standards evolve. Verify current requirements with official CMMC materials and your assessor.