Maintain your systems on a real schedule — patches, updates, upkeep.
What it actually means
Perform maintenance on organizational systems — the routine upkeep that keeps systems secure and functional: patching, updates, hardware servicing, and scheduled maintenance. Have a process so maintenance actually happens and is recorded, rather than being ad hoc.
Pass or fail — an assessor needs a "yes" to each
- Do you perform and document maintenance on your systems on a defined basis?
- Is there a process so maintenance is scheduled, not just reactive?
What to have ready
- Maintenance policy or schedule
- Maintenance records or ticketing history
Where teams trip up
- Maintenance only when something breaks
- No record that maintenance was performed
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →