NIST 800-53 REV 5 • MAINTENANCE
MA-5(3) — Citizenship Requirements for Classified Systems
Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are U.S. citizens.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
Supplemental Guidance
Personnel who conduct maintenance on organizational systems may be exposed to classified information during the course of their maintenance activities. If access to classified information on organizational systems is restricted to U.S. citizens, the same restriction is applied to personnel performing maintenance on those systems.
Practitioner Notes
For classified systems, maintenance personnel must be U.S. citizens. This is a non-negotiable requirement for systems processing national security information.
Example 1: Include citizenship verification as part of your maintenance personnel authorization process. Verify U.S. citizenship through your HR records or the technician's employer. Document the verification in their authorization file.
Example 2: Add citizenship verification to your vendor contract requirements for any work involving classified systems. Include a contract clause requiring the vendor to certify that all maintenance personnel assigned to your classified systems are U.S. citizens.