ISO 27001 Control A.7.13: Equipment Maintenance

Equipment ages, and ageing equipment fails at the worst moments. A UPS battery that has quietly lost most of its capacity, a cooling unit with a clogged filter, a firewall appliance running long past the last firmware update. Maintenance is what keeps those problems small. It is also, less obviously, a moment of exposure: the engineer who comes to fix a server has hands on your data. A.7.13 is the thirteenth of 14 physical controls in our walk through Annex A, and it covers both sides of that coin.

Maintenance has a reputation as dull housekeeping, yet it appears in surprisingly many incident reports. Failed disks that were never replaced, warranty swaps that carried data away, and remote support sessions left open after a repair all start with maintenance that nobody planned. A little structure removes most of the risk.

What the control requires

Annex A control 7.13 of ISO 27001:2022 states that equipment shall be maintained correctly to ensure availability, integrity and confidentiality of information.

The key elements:

Equipment - the hardware that supports your information processing, such as servers, network devices, power and cooling plant, security systems and end-user devices
Maintained correctly - serviced, updated and repaired in line with supplier specifications and your own needs
Availability, integrity and confidentiality - the three outcomes at stake: equipment that keeps working, that has not been tampered with, and that does not leak data during servicing

A.7.13 is a preventive control as classified in ISO/IEC 27002:2022. Annex A states the control; ISO 27002 offers guidance, which includes maintaining equipment in accordance with the supplier’s recommended service frequency and specifications, allowing only authorized maintenance personnel to carry out repairs, keeping records of all suspected or actual faults and of all preventive and corrective maintenance, and using appropriate controls when sending equipment off-premises for maintenance. The guidance also points to checking equipment after maintenance to confirm it has not been tampered with and still functions properly, and to supervising maintenance personnel who have access to the organization’s information.

How to implement equipment maintenance

Plan servicing around what matters

Start from your inventory and sort equipment by criticality. For each important item, record the supplier’s recommended service interval, the warranty or support contract that covers it, and the person responsible. Typical items in scope include UPS units, generators, air conditioning, fire detection and suppression, access control and alarm systems, network hardware and servers. Add dates to a calendar, not to a memory. Support contracts deserve a close look: confirm that response times fit your tolerance for downtime, as thought through under supporting utilities, and note the end-of-support dates for hardware so you can replace it before it becomes a risk.

Keep a maintenance log: what was done, when, by whom, and what was found. A shared spreadsheet is enough for a small organization. The log is useful for troubleshooting and it is exactly what auditors ask to see.

Control who touches the equipment

Only authorized people should maintain your equipment, and you should know who they are. Use named suppliers under contract, agree what they may access, and make sure they are bound by confidentiality, as discussed in confidentiality or non-disclosure agreements. When engineers visit, record their arrival, escort them, and watch what they do in line with the rules in working in secure areas. Ask them to show identification, and verify unexpected visits with the supplier before letting anyone in. Social engineering through a fake engineer is old but effective.

Remote maintenance needs the same attention. Grant access only for the session, use accounts that can be traced, monitor what happens, and switch it off afterward. A support tunnel left open for months is an unmonitored door to your network.

Protect data during repair and servicing

The confidentiality part of the control becomes real when equipment leaves your hands. Before sending a device for repair, decide whether storage media can be removed, whether the data on it is encrypted, and whether the repairer can be trusted with what remains. Where the device holds sensitive information, remove or wipe the media first if the fault allows, or keep the media and send only the hardware. Where neither is possible, rely on encryption and a contract that covers confidentiality, and record the decision. The same principles apply to equipment travelling to a repairer, which links to the points in security of assets off-premises and to storage media management.

After the work is done, inspect the result. Confirm that the equipment functions properly, that nothing unexpected was installed, and that settings, passwords and remote-access options are as they should be. For security systems, test that alarms, access control and cameras still behave correctly.

Fit maintenance into change management

Maintenance can alter the system: firmware updates, hardware replacement, configuration resets. Treat significant work as a change, with planning, approval, a back-out option and testing. Schedule disruptive work outside critical periods, and warn users. Where equipment is replaced, update the asset inventory and remember that the retired unit still contains data until it is handled properly. Our upcoming post on A.7.14, Secure disposal or re-use of equipment, deals with that moment. Finally, make use of the data you gather: repeated faults on the same item, or a cluster of near-failures, are signals for replacement and belong in your management reporting.

Keep an eye on the whole fleet

Small organizations often discover that maintenance has two blind spots: equipment bought on a credit card and never registered, and equipment that belongs to a landlord but protects your systems. Ask finance for recent hardware purchases and compare them with the inventory. Ask the landlord who services the shared air conditioning, fire systems and electrical panels, and how you will hear about planned shutdowns. These two conversations usually uncover the items most likely to fail unnoticed, and they take an afternoon.

A.7.6 connection. Working in secure areas sets the rules for supervising engineers inside restricted spaces.

A.7.8 connection. Equipment siting and protection determines where equipment lives, which affects how it can be maintained safely.

A.7.9 connection. Security of assets off-premises applies when equipment leaves for repair.

A.7.10 connection. Storage media covers the data-bearing parts that may be removed, replaced or returned during maintenance.

A.7.11 connection. Supporting utilities includes the power and cooling plant that most needs regular servicing.

A.6.6 connection. Confidentiality or non-disclosure agreements bind the people who maintain your equipment.

Clause 8.1 connection. Operational planning and control expects planned control of operations, which includes scheduled maintenance.

Forward reference. Secure disposal or re-use of equipment (A.7.14) follows next in the series, and the later controls on management of technical vulnerabilities (A.8.8) and change management (A.8.32) deal with patching and changes made during maintenance.

What auditors check

A maintenance schedule. Auditors look for planned servicing of critical equipment in line with supplier recommendations.

Maintenance records. Logs of preventive and corrective work, with dates and the people who carried it out, are the standard evidence.

Contracts and support. They check that support agreements exist for critical items and that equipment is still supported.

Supervision and access. Expect questions about how engineers are authorized, identified and supervised, including remote sessions.

Equipment sent out. Auditors ask what happens to data when a device goes for repair, and look for records of the decision.

Post-maintenance checks. They look for evidence that equipment was tested after service, especially security equipment such as alarms and access control.

Common mistakes to avoid

Maintenance by memory. Without a schedule, servicing happens after something breaks, which is too late.

Unsupervised engineers. A supplier alone in a server room is a classic finding, and it is easy to prevent.

Open remote access. Support connections that stay enabled between visits are a standing risk.

Sending devices away with data on them. Repairs and warranty swaps move your information to someone else. Decide beforehand and record it.

Unsupported equipment. Hardware past end-of-support receives no fixes and often no spare parts. Track the dates and plan replacement.

No records. If the work is not logged, an auditor cannot tell that it happened, and neither can you when a fault returns.

Skipping checks afterward. A repaired device that has not been tested may be broken in a new way, or altered in a way you did not intend.

How 27kay can help

We help organizations build maintenance routines that are light enough to maintain and strong enough to show an auditor, covering schedules, supplier access, remote sessions and what happens to data during repairs. As part of ISO 27001 implementation, we review your critical equipment with you, tighten supplier arrangements and prepare the evidence you need. For the full picture, see our ISO 27001 knowledge hub.

When did someone last check the battery in the UPS that protects your server, and who was watching the engineer who did? Get in touch - we will help you turn both answers into routine.