Control the work, the tools and the access used to maintain your systems.
Work through all six requirements and 10 assessment objectives. Plan and record maintenance, check diagnostic media, protect CUI before off-site repair and verify remote access and supervision. Start with the systems and tools you already use.
Sources reviewed October 27, 2026. These instructions have not been tested in a Microsoft tenant. This guide does not establish compliance or replace an official assessment. Suggested checks and manual worksheet states are working aids.
Identify the work and the system. Include hardware, software, firmware and provider work. Use Do we handle CUI? and your boundary records to understand which data and services are involved.
Approve how the work will be done. Check the tool, technique, connection, technician and required authorization. Agree scope, impact, backup/recovery and return-to-service checks.
Handle media before use or release. Inspect diagnostic/test media through an approved route before use on CUI systems. Sanitize CUI before equipment leaves for off-site maintenance and verify the result.
Control remote access and supervision. Check MFA for applicable external maintenance sessions, effective supervision where required, and actual connection termination when work ends.
Keep actual results. Record what happened, who checked it and what remains open. A schedule, clean-looking screen or completed template does not establish successful maintenance.
Use fictional records for the exercises. Never erase a real device, connect unknown media, change remote access or end production sessions as a discussion exercise. Keep CUI, credentials, detailed system records and evidence in your approved environment. This website does not receive completed worksheets or exercise answers.
Keep hardware and software in working order through planned and corrective maintenance. Include firmware, support tools and the systems protecting CUI. A patch calendar or a provider contract does not show that the work was carried out.
Official requirement and assessment objectives
Perform maintenance on organizational systems.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.1
Objective
Official text
3.7.1
Determine if system maintenance is performed.
What to do
Identify the work and who owns it
Use the inventory, vendor support instructions, service needs and observed faults to identify maintenance. Include physical equipment, Windows, applications, firmware, AVD images/hosts and supporting services as relevant. Set owners and timing based on the actual equipment, risk and obligations; CMMC does not give every device one universal interval.
Authorize and prepare the activity
Agree the scope, technician, method, expected impact, needed access and recovery arrangement. Coordinate downtime, dependent users/services and provider work. Link changes to Configuration Management and security updates to your patch process. Do not use a maintenance request to bypass approval or widen access indefinitely.
Record what happened and check the result
Keep actual start/end times, work performed, approved changes, parts/tool references, errors and verification. Confirm business function and security settings before return to service, with an accountable reviewer. Record overdue, incomplete or failed work and a next action instead of marking it done from a scheduled date.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.1
Trace a relevant system from identified maintenance need through actual performed work and post-maintenance checks, including provider work where delegated.
Records to keep: Inventory/work reference, schedule or fault, authorization, actual work record, verification and remaining actions.
Records to keep
System scope, planned/corrective work, responsible owner and provider duties.
Authorized activity, actual work, verification, return-to-service decision and unresolved items.
If a check fails
If maintenance fails, stop within the approved procedure, protect data and use the supported recovery or replacement route. Recheck access, security and service operation before release. Treat unexplained changes or suspected compromise through Incident Response rather than repeatedly rerunning a tool.
Working with a small budget
Start with vendor instructions, existing inventory/patch records and the free activity register. Office applications can hold records; they do not perform maintenance. Support, spare parts, replacement hardware and out-of-support systems can still create costs.
Approve how maintenance is done as well as who does it. Separate the tool itself, the technique, the connection or other mechanism, and the personnel. A trusted vendor name does not answer all four questions.
Official requirement and assessment objectives
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.2
Objective
Official text
3.7.2[a]
tools used to conduct system maintenance are controlled.
3.7.2[b]
techniques used to conduct system maintenance are controlled.
3.7.2[c]
mechanisms used to conduct system maintenance are controlled.
3.7.2[d]
personnel used to conduct system maintenance are controlled.
What to do
Define permitted tools and techniques
Record approved tool sources, versions, intended uses and restrictions. Include scripts, boot/diagnostic utilities, portable devices, remote-support agents and vendor packages. Define permitted procedures and changes, including what needs extra authorization. Review source authenticity and supported integrity/signature checks without treating a signature as proof that a program is safe.
Control mechanisms and personnel
List approved on-site, remote, management-console and service access routes. Assign individual identities, least necessary rights, scope and duration, with logging and closure checks. Verify the technician and engagement through an established contact route; a badge, purchase order or unsolicited support call alone does not establish access authorization.
Compare the approved method with actual work
Check representative work records for the tool, technique, connection, technician, authorization and observed result. Investigate unapproved agents, tools or access paths. Keep provider/customer responsibilities explicit. A tool register does not prove every installed agent or maintenance activity was controlled.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.2[a]
Check the source, approval, scope and restrictions of the tools actually used for maintenance.
Records to keep: Tool register, approved source/version references, allowed use and sampled work records.
3.7.2[b]
Check the actual maintenance method follows approved procedures and authorized changes.
Records to keep: Procedure/version, change decision, permitted technique and observed work/result.
3.7.2[c]
Check the maintenance connection or mechanism is approved, scoped and controlled.
Records to keep: Access/agent/console configuration, identity, permissions, connection records and closure result.
3.7.2[d]
Check each person doing the sampled work was identified and controlled under the applicable access and supervision process.
Records to keep: Technician verification, work approval, authorization limits, access duration and supervisor where needed.
Records to keep
Approved tools, techniques and maintenance mechanisms, including prohibited uses.
Identified personnel, authorization, controlled access and actual sampled activity.
If a check fails
For an unexpected tool or access request, pause and verify through the established owner/provider route. Do not give a vendor an unrestricted account or disable protection to finish faster. Preserve relevant records and escalate suspicious activity through the incident process.
Working with a small budget
Use existing administration tools and a controlled tool register first. Remote Help, third-party management, recording and access-policy features may need eligible licensing. A free download still needs approval, safe handling and an appropriate access route.
Remove CUI before equipment leaves for off-site repair
Check the equipment and every relevant storage component before release. A shipping approval, encrypted-drive screen or promise from the repair company does not establish that CUI was sanitized.
Official requirement and assessment objectives
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.3
Objective
Official text
3.7.3
Determine if equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.
What to do
Find the data and decide the repair route
Identify equipment, drives, removable storage and other components that may hold CUI, including cached files or diagnostic data. Confirm backup/recovery and any evidence/retention hold before an authorized sanitization. If appropriate, arrange on-site repair or retain storage under your control. Verify the actual equipment leaving contains no remaining CUI; taking out one drive is insufficient if other storage holds it.
Use an approved method suited to the medium
Have the authorized owner select a supported sanitization process using applicable policy, current NIST guidance and vendor instructions. Consider device/media type, sensitivity, hidden/reserved areas, failures and the chosen technique’s limits. Ordinary file deletion or quick formatting is not evidence of sanitization. Existing encryption alone does not establish cryptographic erase; that method needs an appropriate design, all relevant key handling and verification.
Verify the outcome before release
Retain the device/media reference, selected method, person, actual date, result, verification/validation and release approval. If the process fails, cannot reach damaged media or cannot be verified, keep the equipment controlled and escalate to an approved alternative. Do not ship it with a gap note as though the requirement was met. Never run erasure as a website exercise.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.3
For equipment leaving organizational spaces for off-site maintenance, check CUI sanitization and its verified result before release. Include the actual storage components and unresolved failures.
Records to keep: Equipment/media references, CUI review, approved technique, execution/verification record, exception handling and release decision.
Records to keep
Equipment/media inventory, data location, backup/hold review and selected repair method.
Sanitization and verification/validation results, release authorization and custody/shipping references without CUI.
If a check fails
If sanitization is incomplete or a failed drive cannot be verified, block release and arrange an approved alternative, such as retaining media or on-site work where appropriate. Coordinate any preservation duty with the responsible personnel before destruction. If unsanitized equipment already left, use Incident Response and evaluate the actual exposure.
Working with a small budget
A controlled repair decision and register cost little. The correct method depends on the hardware; qualified sanitization, retained-drive support, replacement media or destruction can cost money. Do not advertise one free wipe utility as suitable for every SSD, embedded device or failure.
Check diagnostic media before it reaches CUI systems
Inspect media containing diagnostic or test programs before using it in the systems that handle CUI. The technician’s claim that a USB drive is clean, or a scan performed after the program ran, leaves the timing requirement unanswered.
Official requirement and assessment objectives
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.4
Objective
Official text
3.7.4
Determine if media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI.
What to do
Use an approved inspection route
Identify the media and programs, their source/version and the work they are meant to support. Inspect them on an authorized system using the approved handling procedure before connection or use in a CUI system. Do not plug unknown media into a CUI endpoint for its first scan. Review autorun, write handling and any cloud sample submission against your approved boundary.
Run and record the required check
Use supported, active antimalware with appropriate current protection and the intended scan scope. Where Microsoft Defender Antivirus is the approved scanner, a targeted file/folder scan is available through Windows Security/Explorer. Review exclusions, inaccessible/encrypted files, errors and skipped content. Record media/program references, scanner/protection context, time and result. A scan that did not cover the relevant content is an unresolved check.
Decide whether the media can be used
Authorize use only after the required checks succeed. Retain the result and link it to the actual maintenance activity. Do not run an unknown utility to see whether antivirus reacts, or add an exclusion to make it execute. A clean scan has detection limits and does not approve the tool or technique by itself. Handle detected malicious code under the incident procedure.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.4
Trace diagnostic/test media used for a sampled job to a malicious-code check completed before use on the CUI system, including scope, failures and the use decision.
Records to keep: Media/program ID, inspection environment, scanner/protection context, actual pre-use time/result, approval or blocked-use/incident reference.
Records to keep
Diagnostic-media source/version and approved inspection method.
Actual pre-use check, coverage limits, result and allowed/blocked-use decision.
If a check fails
For a detection, failed scan or uninspectable content, do not use the media. Keep it controlled under the approved incident/handling procedure and obtain a trusted replacement or qualified review. If it was already used, preserve relevant records and assess affected systems through Incident Response.
Working with a small budget
An approved existing antivirus and controlled inspection workstation may cover the task. Additional media-control products are optional choices, not a substitute for the before-use process. Do not upload confidential files or diagnostic bundles to public scanning services.
Require MFA and close external maintenance connections
Identify every nonlocal maintenance route using an external network. Require MFA to establish the applicable sessions and verify the connections are terminated when the work is complete. Method registration and an idle remote window do not establish either result.
Official requirement and assessment objectives
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.5
Objective
Official text
3.7.5[a]
multifactor authentication is used to establish nonlocal maintenance sessions via external network connections.
3.7.5[b]
nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete.
What to do
Map the full maintenance connection
Include the support service or RMM agent, VPN/gateway, direct RDP or other administration, AVD service and host, vendor consoles and permitted fallbacks. Record the actual technician identity, target, authentication authority and external route. A cloud MFA policy does not automatically cover a local account or another remote-support product.
Verify MFA for establishment
Use approved configuration and a harmless authorized test in a suitable environment to check enforcement and the actual authentication result for each applicable route. Report-only policy and registered-method counts are not proof. An existing MFA claim may satisfy a session without a fresh prompt; inspect the result. Keep unverified or uncovered routes open and use the detailed MFA guide for supported identity/cloud paths.
End the work and verify termination
Use the supported end-session/connection procedure, confirm it actually ended and record the time/result. Closing an RDP client can leave a disconnected server session; review the host session and other maintenance connections too. Remove temporary permissions or access as approved. A permanently installed management agent needs a controlled future access policy, not an assumption that every agent must be uninstalled after a job.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.5[a]
Check enforced MFA and actual establishment evidence for applicable nonlocal maintenance via external networks, including alternate paths.
Records to keep: Route/identity map, effective enforcement, authentication result, permitted fallbacks and unresolved coverage.
3.7.5[b]
Check the relevant connections are terminated when maintenance is complete and that remaining session/access state is handled under the approved procedure.
Records to keep: Actual completion and termination times, service/host status, temporary-access closure and failed-termination follow-up.
Records to keep
External maintenance route, technician identity, effective MFA and actual authentication evidence.
Work completion, observed connection/session closure and remaining access decisions.
If a check fails
If MFA is not enforced or a connection remains open, record the gap and use an authorized supported correction. Coordinate dependency and recovery needs before blocking access. Do not disable tenant protections, close every user session or leave a temporary bypass as an undocumented workaround.
Working with a small budget
Use the supported MFA and remote-management capabilities already licensed where they meet the actual path. Conditional Access generally needs an eligible Entra license; the authenticator app alone is not enforcement. Quick Assist is not automatically an approved CUI route or a replacement for organizational access controls.
Supervise technicians who lack the required access authorization
Know the authorization needed for the specific maintenance activity. Arrange supervision for personnel who lack it, and control what they can see and do. A service contract or screen-sharing consent is not permission to access CUI.
Official requirement and assessment objectives
Supervise the maintenance activities of maintenance personnel without required access authorization.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.7.6
Objective
Official text
3.7.6
Determine if maintenance personnel without required access authorization are supervised during maintenance activities.
What to do
Check the person and the authorization
Verify the technician through the established provider route, identify the actual work and compare their authorization with the required access. The requirement concerns access authorization; do not invent a rule that every maintenance technician needs a government security clearance. Link approved identities, physical access and provider responsibilities.
Arrange effective supervision and limits
Assign an appropriately authorized, capable supervisor for the activity. Define allowed actions, visible information, access boundaries and the ability to intervene. Keep supervision active for the work requiring it, on-site or remotely as applicable. A recording reviewed later or an unattended connection is not a substitute for the required supervision. Do not expose CUI to an unauthorized technician merely because a supervisor is present.
Record the activity and close access
Retain technician/supervisor references, approved scope, actual supervision period, work/result and any deviation. Pause if supervision cannot continue and make an approved handover before resuming. Review temporary rights, tools and session closure with the maintenance record.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the maintenance control worked.
3.7.6
For maintenance personnel without required access authorization, verify an authorized supervisor actually supervised the activity within defined limits and could intervene.
Records to keep: Required versus held authorization, assigned supervisor, scope/limits, actual observation/time record, handover or stopped-work result.
Records to keep
Technician identity and authorization review, supervisor and permitted scope.
Actual supervision and work record, deviations/handover and closure checks.
If a check fails
If the supervisor is unavailable or work exceeds the agreed boundary, pause and restrict the activity through the approved process. Arrange an authorized replacement or different method. Treat suspected unauthorized access or disclosure through the incident process; do not recreate a supervision record after the fact.
Working with a small budget
A small team can use an authorized staff member and a controlled procedure. If effective supervision cannot be provided, reschedule or use another approved arrangement. A paid session-recording tool does not supply a missing supervisor or create CUI access authorization.
Use the actual identity authority, tenant cloud, device join and maintenance route. These examples are preparation guidance and have not been tested in a Microsoft tenant. Before live work, obtain authorization, confirm supported procedures and agree recovery. A Microsoft subscription does not make every tool or service suitable for CUI.
AD DS and hybrid joined Windows
Map domain and local maintenance accounts, approved tools, access groups, management routes and provider responsibilities. Use individual identities and the rights needed for the job. A synchronized identity, hybrid joined device and local administrator are different records.
Link approved changes to Configuration Management. Retain representative work and relevant Windows/remote-access records in approved storage. Do not turn on broad access or copy an unreviewed script merely because it came from a technician.
For external maintenance, check supported MFA through the actual access route and verify the relevant connection ends. A cloud policy does not automatically protect direct RDP, a local account, VPN or another support product. Coordinate domain, cloud and local recovery before making changes.
Microsoft Entra joined Windows
Confirm the helper identity, permitted device scope, target account and actual support mechanism. Entra join does not itself enforce MFA for every remote tool. If using Remote Help, review supported platform, RBAC and Conditional Access. Check a safe authorized connection and the actual end-session result. Include local administration and alternate agents rather than reviewing only the cloud portal.
Commercial Microsoft 365 and Intune
Use your existing supported management tool where it meets the requirements. For Remote Help, verify entitlement for helpers and sharers, same-tenant scope, supported devices and permitted control level. Installed Office apps do not establish those licenses.
In the supported Remote Help configuration, restrict helper roles and device scope, then review the applicable Conditional Access enforcement and actual authentication result. Check current documentation before enabling attended or unattended access. An unattended option does not supply required supervision for a technician who lacks access authorization.
Retain job, tool, access, supervision and end-of-work records. Review the service result and relevant host/identity records. Keep incomplete logging or unverified connection paths open. A session list or recording does not prove every Maintenance objective.
GCC, GCC High and Azure Government
Check the identity tenant and each service instance. At this source review, Microsoft lists Remote Help for supported platforms in GCC and GCC High, but not DoD tenants, and does not support Remote Help for AVD in GCC or GCC High. Do not reuse a commercial AVD example for that route. Choose an approved supported alternative and document MFA, access, supervision and termination for it. Use the correct national-cloud endpoints and keep records inside the approved boundary.
Azure Virtual Desktop
Record the AVD service, actual AD DS/hybrid/Entra host join, image/version, users, applications, profiles/storage and provider responsibilities. Include direct administration and remote agents. Microsoft-managed hardware maintenance and your session-host work have different owners; retain the applicable provider evidence instead of marking the whole domain out of scope.
For a planned host window, authorized operators can use Azure Virtual Desktop → Host pools → Session hosts → Turn drain mode on under the supported procedure. Drain mode stops new brokered sessions; existing sessions remain, and direct administrative connections are still possible. Coordinate users and capacity before ending sessions or shutting down a host.
Inspect actual session state and perform approved work only when the window and dependencies permit. Check the image/host, security settings, profile/storage access and business function afterward. Restore acceptance of new sessions only after authorized checks and a return-to-service decision.
Verify the vendor/support, gateway and host maintenance connections actually ended. A disconnected host session is different from logoff. Review temporary access and any retained agent’s approved future-access controls. Drain mode, a closed window or host replacement is not complete proof of termination or safe recovery.
Use the detailed MFA guide for commercial/government and AD DS-only, hybrid and Entra paths. Check the actual maintenance connection, not just an ordinary user’s AVD sign-in.
A diagnostic-media check with existing Windows tools
On an approved inspection system, confirm the intended antivirus is active and permitted to inspect the media. Where Microsoft Defender Antivirus is used, Microsoft documents right-clicking a file or folder, selecting Show more options where needed, then Scan with Microsoft Defender. Record the actual scope, protection context, time and result, including errors, exclusions or skipped content. Use your approved removable-media procedure before connection; do not make a CUI device the first inspection point.
A signed utility or clean scan does not approve its use by itself. Do not upload CUI, confidential diagnostic files or evidence to a public scanning site. If a check fails, keep the media controlled and use Incident Response where appropriate. No live malware or unknown-media test is included here.
Included tools and costs to check
Use the free Office materials, vendor instructions, existing logs and approved built-in tools first. Quick Assist is a remote-assistance option with different organizational controls; its availability does not establish MFA, authorization, auditing or suitability for CUI. Remote Help needs eligible helper/sharer entitlement, and Conditional Access generally needs eligible Entra licensing. Check your actual bundle before buying. Repair parts, secure media handling, retained-drive options and specialist sanitization may also cost money.
These situations are fictional. Discuss them with the system owner, maintenance technician, supervisor and person who approves return to service. Use the Word exercise pack for facilitator notes. Record what participants actually did and what was only proposed. These example answers are not test results.
Supports 3.7.1, 3.7.2, 3.7.3
A failed laptop is ready to ship with its original storage
Fictional exercise: a small contractor has a warranty return for a laptop that held CUI. The device no longer boots. A shipping label is ready and the inventory says encryption was enabled, but no sanitization or verification record exists. The team has not checked other storage or whether a retention hold applies.
Discuss
What must be established before equipment leaves for off-site maintenance?
Does an encryption entry or a shipping approval establish sanitization?
What should happen if the failed media cannot be sanitized and verified?
What a useful response includes
Hold release while the authorized owner identifies all relevant equipment/storage and CUI locations. Review backup/recovery and any evidence/retention duty before authorizing sanitization or another repair arrangement.
Select an approved supported method suitable for the actual medium, then retain execution and verification/validation results and release approval. Do not treat deletion, a quick format, encryption status or the warranty as proof.
If the result cannot be verified, keep the media controlled and arrange an approved alternative, such as retaining storage or on-site work where appropriate. Confirm all equipment actually leaving is free of CUI. Do not wipe or ship anything for this exercise.
Lesson: An off-site repair decision needs evidence before release. Damaged storage and warranty arrangements do not remove the CUI sanitization requirement.
Record: Write a fictional maintenance row with equipment references, unknown data locations, blocked release, approval/verification work and an owner. Record proposed work as not performed.
Supports 3.7.2, 3.7.4, 3.7.6
A vendor brings diagnostic media and the supervisor must leave
Fictional exercise: a verified hardware vendor arrives with a USB diagnostic tool. The technician lacks the access authorization required for the system. The assigned supervisor is called away. Someone suggests plugging the USB into the CUI workstation to scan it there and letting the technician continue under a session recording.
Discuss
Which tool, technique, mechanism and personnel controls need separate checks?
Where and when should the diagnostic media be inspected?
Can a recording replace the required supervision or authorize CUI access?
What a useful response includes
Verify the approved work, tool source/version, permitted technique, access mechanism and technician authorization. A known vendor identity does not approve every utility or connection.
Use the approved inspection environment before use on the CUI system. Record scanner/protection context, scope, actual result and any errors or skipped content. A detection or incomplete check blocks use and follows the incident/handling procedure.
Pause work if required supervision is unavailable. Arrange an authorized capable replacement and defined limits before continuing. A recording alone is insufficient, and supervision does not authorize disclosure of CUI to the technician. Do not connect media or change access during this discussion.
Lesson: A successful scan and an authorized work order answer different questions. Pre-use media checks and actual supervision both need evidence.
Record: Write fictional tool/media and activity rows with missing checks, supervision limits, the stopped-work decision, owner and next review. Do not invent a completed scan or observed supervision period.
Supports 3.7.1, 3.7.2, 3.7.5, 3.7.6
The AVD maintenance window ended but the connections were not checked
Fictional exercise: an administrator puts an AVD host into drain mode for vendor maintenance. The vendor closes its remote window and says the work is finished. Existing user sessions remain, the technician's maintenance session is disconnected and another remote-support agent is installed. The only MFA evidence is a registered authenticator method. The team has not confirmed the tenant cloud or whether its proposed Remote Help path supports that AVD environment.
Discuss
What does drain mode establish, and which access paths remain?
What would establish MFA for the actual nonlocal maintenance route?
How should the team verify completion, termination and return to service?
What a useful response includes
Review the AVD service, actual host join, direct administrative connections, vendor agent and permitted fallbacks. Drain mode blocks new brokered sessions but does not end existing sessions or every direct connection. Check current cloud/platform support before choosing the tool.
Check effective MFA enforcement and actual authentication results for the applicable external maintenance sessions. Registration and report-only policy are insufficient. An earlier MFA claim may satisfy the session without a fresh prompt; inspect the result rather than guessing.
Use the supported end-session/connection procedure and confirm termination. Review temporary rights and the approved future-access policy for any retained agent. Verify service/security operation and obtain return-to-service approval. A closed client window, drain mode or a proposed action is not proof that every connection ended. Do not close real sessions for this exercise.
Lesson: Maintenance completion, session termination and service recovery are separate checks. A tool name or one cloud sign-in does not establish coverage of all maintenance connections.
Record: Record fictional route and work references, missing authentication/termination evidence, provider/supervisor responsibilities, return-to-service checks, owner and proposed verification. Keep technical actions marked unperformed.
Five free Word and Excel materials
Download a copy and adapt it in your approved environment. Blank inputs and fictional examples are separate. Use restricted references; keep CUI, credentials, detailed system records and evidence in approved storage. The templates do not calculate a compliance score.
Excel
Maintenance activity register
Record approved work, technician and supervision references, tools, remote-session checks, off-site decisions and the actual return-to-service result.
Ready for record review means a row is prepared for someone to examine. It is not completed maintenance, a clean-media result, release approval or a compliance finding. Keep remaining limitations and next actions explicit.
Turn an unchecked maintenance step into an assigned action
In a fictional review, a vendor says its remote window was closed but nobody checked the maintenance connection. The team keeps 3.7.5[b] as Evidence to check in the Level 2 gap-and-action worksheet, links the maintenance record and assigns a safe verification. It does not mark the objective met from the technician’s message alone.
Sources reviewed October 27, 2026. Official text is separate from our suggestions. Product documentation supports the features and limits described; it does not establish that your deployment works or that a service is suitable for your CUI. Sanitization methods, access authorization and provider responsibilities depend on your actual systems and obligations. This guide does not choose a sanitization technique or approve a cloud service for your CUI.
Current supporting guidance on a sanitization program, appropriate techniques and assurance. It does not replace the CMMC Revision 2 baseline or select a method for your equipment.
Supported targeted scans where Microsoft Defender Antivirus is available and active. Use an approved inspection environment and retain the actual result.
Check helper/sharer licensing, same-tenant restrictions, supported platforms, Conditional Access and government-cloud limits. A Remote Help login alone does not establish every Maintenance objective.
Remote assistance and user consent, with different organizational controls from Remote Help. Do not assume it is an approved CUI maintenance route or meets MFA/auditing needs.
Separate customer/partner-managed hosts and supporting services from Microsoft-managed components. Document provider evidence for delegated maintenance.
Email cmmc@purposefulsecurity.com with a general description. Keep CUI, credentials, detailed system records, logs, evidence and completed worksheets in your approved environment. Do not email them to us.