Equipment maintenance
Purpose
Maintain equipment correctly to keep information available, accurate and confidential and avoid disruption from breakdowns.
How to meet this control
In short: Maintain equipment correctly to ensure availability and integrity.
- Step 01Maintain equipment to the supplier-recommended service frequency and run a maintenance programme tracked across the organisation
- Step 02Restrict repairs and maintenance to authorised personnel and supervise on-site technicians for the duration of their visit
- Step 03Keep records of suspected and actual faults and of all preventive and corrective maintenance performed
- Step 04Require confidentiality agreements for maintenance providers and control remote-maintenance access tightly
- Step 05Apply off-premises protections and check for tampering when equipment is sent away and returned
- Step 06Apply secure disposal or reuse measures if maintenance results in equipment being retired
Tip: Keep maintenance records; supervise third-party technicians.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Maintain equipment following the supplier recommended service frequency and specifications
- ›Run and monitor a maintenance programme across the organisation
- ›Allow only authorised personnel to carry out repairs and maintenance
- ›Keep records of suspected and actual faults and of all preventive and corrective work
- ›Apply controls based on whether maintenance is on-site or off-site, with confidentiality agreements
- ›Supervise on-site maintenance staff and control access for remote maintenance
- ›Apply off-premises protections when equipment is taken away and check for tampering on return
- ›Apply secure disposal or reuse measures if equipment is to be retired
Audit evidence to keep
- - The maintenance schedule and completed maintenance records
- - Fault and repair logs
- - Confidentiality agreements with maintenance providers
- - Records of supervision or access control for maintenance visits
- - Tamper-check records for equipment returned from off-site repair
Common mistakes
- - Relying on office trust without logs
- - Not tracking assets used away from the office
- - Disposing equipment without wipe or destruction evidence
Owner, cadence, and proof
Assign one accountable owner for A.7.13. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.