7.13 Equipment maintenance
Equipment is to be properly maintained so that information stays available, intact and confidential. Purpose: keep poor upkeep from causing information or assets to be lost, stolen, harmed or compromised, or from stopping operations. Guidance: consider servicing equipment at the intervals and to the specifications the supplier recommends; running and monitoring the organization's own maintenance programme; allowing only authorized maintenance staff to repair or service equipment; recording every suspected or actual fault and all preventive and corrective maintenance; applying suitable controls when maintenance is scheduled, depending on whether it is done by on-site staff or outsiders, with maintenance staff bound by an appropriate confidentiality agreement; supervising maintenance personnel on site; authorizing and controlling remote maintenance access; applying off-premises protections (7.9) when equipment holding information leaves for repair; meeting any maintenance requirements set by insurers; inspecting equipment before it returns to service to confirm it has not been tampered with and works correctly; and applying secure disposal or reuse measures (7.14) if the equipment is going to be scrapped. In this control, equipment covers processing components, UPS units and batteries, generators, alternators and converters, intruder detection and alarm systems, smoke and fire equipment, air conditioning and lifts.
Source: ISO/IEC 27002:2022, 7.13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Maintenance and fault logs recording faults and preventive and corrective work · SIEM / log platform
periodic reviewEvidence produced at each review
- Supervision records for on-site maintenance and authorization and logging of remote maintenance sessions · SIEM / log platform
- Post-maintenance inspection records confirming no tampering and correct function before return to service · Document repository
- Evidence insurance-imposed maintenance requirements are met · Document repository
governing documentDocuments that govern the control
- A maintenance programme and schedule aligned with supplier-recommended intervals and specifications, covering IT, power, fire, alarm and HVAC equipment · Vendor register / contract repository
- Lists of authorized maintenance personnel and signed confidentiality agreements · Vendor register / contract repository
First move
Common gaps auditors find
- Remote maintenance access by vendors is permanently enabled and unmonitored
- Maintenance of fire, alarm and power equipment is not tracked alongside IT equipment
- Equipment returns from repair without any check for tampering
- Engineers work unsupervised in data rooms
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.12 Cabling security · 7.14 Secure disposal or re-use of equipment