A.7.13 Equipment maintenance
Maintain equipment correctly to preserve availability, integrity and confidentiality.
8
artefacts
2
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Equipment maintenance log · SIEM / log platform
- Service ticket records system · SIEM / log platform
periodic reviewEvidence produced at each review
- Quarterly maintenance calendar · Document repository
governing documentDocuments that govern the control
- Annual maintenance plan · Policy repository / GRC workspace
- Calibration certificate printer · Document repository
- Temperature sensor calibration report · Document repository
- Vendor service agreement printer · Vendor register / contract repository
- Hardware warranty and maintenance contract · Vendor register / contract repository
First move
Start with the 2 of 8 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- no documented maintenance schedule
- maintenance logs lack timestamps
- absence of calibration certificates
- informal repairs without records
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.7.12 Cabling security · A.7.14 Secure disposal or re-use of equipment