Insights · Checklist
Secure maintenance window checklist
Maintenance is when controls are loosened on purpose. This checklist governs the window from authorization to closure, so that nothing opened stays open and nothing changed goes unrecorded.
How to use it
Before the first step.
- One checklist per window; retained as the change record.
- Closure is verified by someone other than the person who did the work.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Document the planned work, systems affected, expected duration and rollback plan. | Change requester | Change request |
| 02 | Obtain authorization from the change authority and the owners of affected services. | Change authority | Approval record |
| 03 | Identify every control to be loosened: accounts, ports, rules, alerts; record each with its restore action. | Change requester | Loosened-control list |
| 04 | Confirm backups or snapshots of affected systems are current and restorable. | IT operations | Backup confirmation |
| 05 | Verify the identity and authorization of every person performing work, including vendors and remote hands. | Change authority | Access authorization record |
| 06 | Confirm monitoring coverage during the window, or compensating observation where alerts are suspended. | Security operations | Monitoring note |
| 07 | Open the window: enable access and make the listed changes only; log every action. | Engineer | Work log |
| 08 | Test the change against acceptance criteria. | Engineer with service owner | Test record |
| 09 | Close the window: restore every loosened control from the list; disable temporary access. | Engineer | Restore confirmation per item |
| 10 | Verify closure independently: configuration, access, alerts, ports. | Second engineer | Verification record |
| 11 | Update configuration and asset records to reflect the change. | Change requester | Updated records |
| 12 | Close the change record with outcome, deviations and any incidents. | Change authority | Closed change record |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days