Equipment maintenance
Equipment is to be properly maintained so that the availability, integrity and confidentiality of information are preserved.
What the requirement asks
Equipment is to be properly maintained so that the availability, integrity and confidentiality of information are preserved. Purpose: keep poor upkeep from causing information or assets to be lost, stolen, harmed or compromised, or from stopping operations. Guidance: consider servicing equipment at the intervals and to the specifications the supplier recommends; running and monitoring the organization's own maintenance programme; allowing only authorized maintenance staff to repair or service equipment; recording every suspected or actual fault and all preventive and corrective maintenance; applying suitable controls when maintenance is scheduled, depending on whether it is done by on-site staff or outsiders, with maintenance staff bound by an appropriate confidentiality agreement; supervising maintenance personnel on site; authorizing and controlling remote maintenance access; applying off-premises protections (7.9) when equipment holding information leaves for repair; meeting any maintenance requirements set by insurers; inspecting equipment before it returns to service to confirm it has not been tampered with and works correctly; and applying secure disposal or reuse measures (7.14) if the equipment is going to be scrapped. In this control, equipment covers processing components, UPS units and batteries, generators, alternators and converters, intruder detection and alarm systems, smoke and fire equipment, air conditioning and lifts. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Maintenance keeps controls working. The guidance asks for the schedule, the competence, the record and the action on a fault.
Status of the guidance. The guidance lens for 7.13 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A maintenance programme and schedule aligned with supplier-recommended intervals and specifications, covering IT, power, fire, alarm and HVAC equipment and one live sample together.
Evidence an assessor asks for
- Maintenance programmeA maintenance programme and schedule aligned with supplier-recommended intervals and specifications, covering IT, power, fire, alarm and HVAC equipment
- Maintenance programmeMaintenance and fault logs recording faults and preventive and corrective work
- Maintenance programmeLists of authorized maintenance personnel and signed confidentiality agreements
- Maintenance programmeSupervision records for on-site maintenance and authorization and logging of remote maintenance sessions
- Maintenance programmePost-maintenance inspection records confirming no tampering and correct function before return to service
- Maintenance programmeEvidence insurance-imposed maintenance requirements are met
The question an assessor will ask
An assessor will ask for A maintenance programme and schedule aligned with supplier-recommended intervals and specifications, covering IT, power, fire, alarm and HVAC equipment, then trace it to the system it protects. For A.7.13 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Remote maintenance access by vendors is permanently enabled and unmonitored
- Maintenance of fire, alarm and power equipment is not tracked alongside IT equipment
- Equipment returns from repair without any check for tampering
- Engineers work unsupervised in data rooms
Before the next audit
Before the next audit, check one live sample for this gap: remote maintenance access by vendors is permanently enabled and unmonitored.