NIST 800-53 r5 · Controls catalogue · Family MA
MA-7Field Maintenance
Restrict or prohibit field maintenance on {{ insert: param, ma-07_odp.01 }} to {{ insert: param, ma-07_odp.02 }}.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (6)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 8,680 | Field maintenance is a critical function; the control supplies the missing authorization step by limiting it to specified entities. |
CWE-284 | Improper Access Control | 4,832 | Restricting field maintenance directly enforces access control over who can interact with or modify the system in uncontrolled environments. |
CWE-863 | Incorrect Authorization | 3,234 | By defining exactly who may perform field maintenance, the control corrects potential authorization errors for this activity. |
CWE-269 | Improper Privilege Management | 2,907 | Maintenance typically requires elevated privileges; limiting field maintenance helps enforce proper privilege management. |
CWE-285 | Improper Authorization | 1,230 | The control requires explicit authorization for maintenance activities, preventing unauthorized parties from performing them. |
CWE-1263 | Improper Physical Access Control | 13 | Field maintenance requires physical or on-site access, and restricting it mitigates improper physical access control. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||