CPCSC Level 2 Control

Last updated June 25, 2026

03.07.05Maintenance

CPCSC Level 2 03.07.05: Non-Local Maintenance

Apply non-local maintenance to control maintenance tools, remote maintenance, and the people who service in-scope systems for CPCSC Level 2 readiness. This guide separates the official ITSP.10.171 control language from practical implementation, evidence, auditor questions, and related controls.

Open Level 2 Guide Browse Level 2 Controls

Formal Control Language

Official ITSP.10.171 wording for 03.07.05. Use the Cyber Centre publication and contract requirements as the source of truth for certification, assessment, or procurement submissions.

  • Approve and monitor non-local maintenance and diagnostic activities.
  • Implement multi-factor authentication and replay resistance in the establishment of non-local maintenance and diagnostic sessions.
  • Terminate session and network connections when non-local maintenance is completed.

Contains information sourced from Government of Canada material used under the Open Government Licence - Canada.

What This Means In Plain English

Non-Local Maintenance is part of the CPCSC Level 2 Maintenance family. This is about controlling who maintains in-scope systems, what tools they use, and how remote or third-party maintenance is approved and observed.

For a founder, CISO, engineer, or compliance owner, the practical question is whether non-local maintenance is visible in real operating evidence: a setting, workflow, ticket, log, approval, review, or exception record that can survive an external assessment.

Level 2 is different from Level 1 because the evidence has to survive an external assessment. A policy statement helps, but the stronger answer is a record that shows who did the work, when it ran, what system setting or workflow enforced it, and how exceptions were handled.

How To Implement It

1

Define the in-scope systems, owners, users, vendors, and data flows affected by non-local maintenance.

2

Approve maintenance tools, restrict remote maintenance paths, verify maintenance personnel, log sessions, and remove tools or access after the work is complete.

3

Translate the formal requirement into one or two operating procedures: who performs it, how often, where it is recorded, and who approves exceptions.

4

Configure the relevant systems so the control is enforced by identity, endpoint, cloud, network, ticketing, monitoring, vendor, or documentation workflows rather than memory.

5

Keep evidence in a consistent folder, GRC system, ticket queue, or audit workspace so an assessor can trace the control from requirement to implementation to review.

Evidence Normally Gathered

Non-Local Maintenance: maintenance tool inventory.

Non-Local Maintenance: remote support approvals.

Non-Local Maintenance: session logs.

Non-Local Maintenance: vendor access records.

Non-Local Maintenance: maintenance tickets.

Non-Local Maintenance: personnel authorization records.

Non-Local Maintenance: owner assignment and review cadence.

Non-Local Maintenance: exception, remediation, or POA&M records when the control is not fully implemented.

Common Auditor Questions

Where is non-local maintenance implemented in the in-scope environment?

Who owns non-local maintenance, and how do they know it is operating?

Show the evidence that proves non-local maintenance ran during the assessment period.

What happens when non-local maintenance fails, is bypassed, or has an exception?

How does this control connect to the system security plan, risk register, POA&M, and related CPCSC controls?

Sources

Source and attribution.

Formal control language is sourced from the Canadian Centre for Cyber Security ITSP.10.171 publication. CPCSC Level 2 assessment context references the Government of Canada CPCSC program overview and ITSP.10.171-01 assessment guidance.

CPCSC Program OverviewITSP.10.171ITSP.10.171-01Open Government Licence - Canada