ISO 27001 Annex A 7.13 Proper maintenance of equipment
What it says
Equipment shall be maintained correctly to ensure availability, integrity and confidentiality of information.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all equipment is regularly maintained to prevent failures and protect data.
This control is about taking care of your organisation's equipment so it works well, protects sensitive information, and doesn't disrupt your business. If you neglect regular maintenance, equipment might fail unexpectedly, causing data loss or security breaches.
Free. Save your status, tasks and notes.
Why it matters
Neglecting equipment maintenance can lead to downtime, compromised data integrity, and increased risk of security breaches.
How to implement
The IT manager should ensure equipment maintenance schedules based on the supplier's recommendations are created and followed.
This involves setting calendar reminders and organising with technicians for regular check-ups.
Procurement should confirm that only authorised service providers are used for maintenance tasks.
Authorisation can involve conducting background checks and having contracts that include confidentiality agreements.
An office manager needs to keep detailed records of all maintenance activities.
This involves logging dates, issues found, and actions taken in a centralised digital or physical logbook.
The HR department should supervise maintenance personnel during their visits.
This involves coordinating with the IT team to ensure that outsiders are accompanied at all times while on-site.
An external consultant or internal auditor should verify equipment returned to operation after maintenance.
This includes checking that it functions correctly and hasn't been tampered with before using it again.
Keep it running
Schedule preventative maintenance, log servicing and faults, track performance, and include patching/AV checks to keep devices reliable.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request maintenance logs and schedules for critical equipment.
Look at
Check dates, nature of maintenance performed, and authorisation of maintenance personnel.
- Check 2 of 5What an auditor asks for
Ask for
See the contracts or agreements with service providers.
Look at
Verify that confidentiality clauses are present and providers are vetted.
- Check 3 of 5What an auditor asks for
Ask for
Request records of audits or inspections post-maintenance.
Look at
Ensure records indicate equipment was checked for tampering or faults.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about the supervision process for maintenance personnel.
Look at
Look for procedural documentation outlining how supervision is conducted.
- Check 5 of 5What an auditor asks for
Ask for
See evidence of action taken for equipment faults or failures.
Look at
Check how incidents were reported and resolved.
Mappings
Closest match in ASD Information Security Manual: ISM-0305, On-site IT equipment maintenance by cleared technicians, which this control covers in full and more.
ASD Information Security Manual: 8 mappings
This control is broader than ISM-0305.
ISM-0305 requires maintenance and repairs of IT equipment to be performed on-site by an appropriately cleared technician to manage security risks from handling equipment. Annex A 7.13 requires equipment to be maintained correctly to protect availability, integrity and confidentiality, which includes establishing secure maintenance practices. ISM-0305 is a specific, higher-assurance maintenance handling requirement (on-site + clearance) whereas Annex A 7.13 is broader and does not require on-site servicing or cleared personnel.
This control is broader than ISM-0306.
Annex A 7.13 mandates correct maintenance of equipment for preserving information security. ISM-0306 supports this by requiring unauthorised or uncleared technicians to be escorted during repairs to prevent data disclosure and maintain the integrity of IT equipment. ISM-0306 is about personnel supervision during maintenance, while Annex A 7.13 is the overarching requirement for proper maintenance practices.
This control is broader than ISM-1079.
Annex A 7.13 requires proper equipment maintenance to ensure security. ISM-1079 supports this by requiring ASD approval before maintaining or repairing high assurance IT equipment, enhancing governance and assurance for critical maintenance activities. ISM-1079 focuses on specific classes of equipment and approval processes, while Annex A 7.13 broadly covers organisational equipment maintenance.
This control partially overlaps ISM-0211.
ISM-0211 requires a cable register to be maintained and regularly verified so that organisations can track physical cabling and ensure it matches the installed environment. Annex A 7.13 requires equipment to be correctly maintained to support availability, integrity, and confidentiality. A regularly verified cable register supports equipment maintenance by helping identify, trace, and service network/communications cabling. While Annex A 7.13 covers all equipment, ISM-0211 focuses specifically on cabling documentation and verification.
This control partially overlaps ISM-0298.
Annex A 7.13 mandates correct maintenance of equipment to ensure the availability, integrity, and confidentiality of information. ISM-0298 overlaps by mandating centralised patch and update management for operating systems, applications, drivers, and firmware, which is a critical aspect of maintaining equipment to prevent failure and compromise. ISM-0298 focuses on patch integrity and deployment assurance, while Annex A 7.13 covers a broader range of maintenance activities, including servicing, repairs, and upkeep of physical assets.
This control partially overlaps ISM-0307.
Annex A 7.13 requires equipment to be maintained correctly to preserve the availability, integrity and confidentiality of information. ISM-0307 relates by requiring sanitisation of IT equipment and associated media before maintenance or repair when an appropriately cleared technician is not used, protecting confidentiality during maintenance. ISM-0307 is narrower and focuses on pre-maintenance sanitisation under specific personnel conditions, whereas Annex A 7.13 includes ongoing preventive and corrective maintenance more broadly.
This control partially overlaps ISM-0310.
ISM-0310 requires that IT equipment maintained or repaired off site is handled only at facilities approved for the equipment's sensitivity or classification. Annex A 7.13 requires equipment to be maintained correctly to protect availability, integrity and confidentiality, which can include controls over who performs maintenance and where it occurs. Annex A 7.13 is broader and does not specifically mandate the use of classification-approved off-site facilities, while ISM-0310 is specifically focused on off-site repair location approval.
This control partially overlaps ISM-1598.
ISM-1598 requires inspection of IT equipment after maintenance/repair to ensure integrity of the approved configuration and identify unauthorised modifications. Annex A 7.13 requires equipment to be maintained correctly to ensure availability, integrity and confidentiality, which includes ensuring maintenance is performed in a way that does not introduce security weaknesses. They overlap because post-maintenance inspection is a practical measure that supports correct maintenance outcomes, but Annex A 7.13 is broader and does not explicitly require configuration verification after maintenance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.