Maintenance Personnel

This requirement covers the outsider fixing your systems, not your own administrators.

Maintenance personnel with required access authorization, your IT staff and the vetted provider technicians documented in your program, are not the subject. Objective [a] is about the one-off vendor engineer, the copier technician, and anyone else who works on systems without authorization for the CUI, Controlled Unclassified Information, that they could touch. Supervise those people while they work.

Supervision is a person watching, start to finish.

Assign an employee who knows what the work should look like to stay with the technician for the duration. Sign the visitor in under your PE.L2-3.10.3 procedure, watch the work, and sign them out. A maintenance log entry naming the technician, the supervisor, and the work performed is the evidence.

Temporary credentials beat borrowed ones.

When the technician needs to log in, issue a temporary account that expires in hours, scoped to the systems under repair, and remove it when the job closes. Never hand over an administrator's own credentials. A borrowed credential defeats both the supervision and your audit trail.

Decide in advance who counts as authorized.

Write down which maintenance personnel hold required access authorization: your administrators and the named provider staff. Everyone outside that list gets the supervised treatment, and the list is what lets you answer [a] without improvising at the door.