Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.07.04Maintenance toolsITSP.10.171Maintenance

Official Requirement

A. Approve, control, and monitor the use of system maintenance tools. B. Check media containing diagnostic and test programs for malicious code before the media are used in the system. C. Prevent the removal of system maintenance equipment containing specified information by verifying that there is no specified information on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Your organization must approve and track all tools used for system maintenance. Any media brought in for diagnostics must be scanned for malware before use. Equipment that may contain sensitive information must not leave your facility unless it has been verified clean, sanitized, or you have explicit authorization for its removal.

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Maintenance tool control and media verification

Implementation steps

  1. Document and maintain an approved list of hardware and software maintenance tools; require management approval before use of any new tool
  2. Scan all diagnostic and test media with up-to-date anti-malware before connecting to systems
  3. Implement application allowlisting on servers and workstations to prevent unapproved maintenance tools from running
  4. Enforce equipment removal procedures: verify data sanitization or obtain documented authorization before any equipment leaves the facility

Tools / systems

Evidence artifacts

Evidence frequency: Per-event tool approval and media scanning; annual approved tools list review