Control A.7.13Equipment maintenance
Equipment must be maintained correctly to ensure availability, integrity and confidentiality of information.
Maintenance is an availability control and an access control at the same time, and the second half is what the standard is drawing attention to. Maintenance is performed by engineers — often external — who need physical access, sometimes administrative access, and who may remove components containing information.
The control asks for maintenance to follow supplier recommendations and intervals, to be performed by authorised people, to be recorded, and to protect the information on the equipment while it happens — including when equipment leaves the premises for repair, where A.7.9 and the disposal considerations in A.7.14 also apply.
The frequent gap is the engineer’s access. An external engineer given an administrative account for the duration of a visit, with no record of what was done and no removal of the account afterwards, is a supplier access path outside everything A.5.18 and A.8.2 are doing.
How to put this in place
Maintenance keeps equipment working but gives outsiders access to it. The project needs authorised people, supervision and a way to protect data when equipment leaves for repair.
- Set a maintenance schedule for in-scope equipment, following the supplier's guidance.
- Allow only authorised engineers, and supervise third parties on site.
- Remove or protect information, for example by encryption or removal of drives, before equipment goes off-site.
- Record each maintenance and repair, including where equipment went.
- Review the records against the schedule.
Evidence an auditor usually looks for: maintenance logs and contracts, supervision records, and records of equipment sent for repair and how its data was protected.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.