ISO 27001 A.7.13: Maintain equipment without losing control

What A.7.13 requires in practice

Annex A control 7.13 asks that equipment is maintained correctly, so that information stays available, accurate and confidential. The control looks at the equipment that supports information processing, including the protective and supporting systems around it. Parts to consider are what needs maintenance and how often, who is responsible, how work is authorised, what access the maintainer receives and how the equipment is protected while it waits for repair. Planned servicing, emergency repair and supplier access can each create exposure if nobody tracks who is working, what may change and how equipment is returned to service. The outputs are a maintenance approach based on the equipment's role and the supplier's recommendations, an owner able to act on overdue work, and records showing authorised and completed work. The standard does not prescribe a maintenance interval or a particular service model.

Define the equipment and its maintenance needs

Identify equipment supporting information processing, including relevant protective and utility systems. A programme focused only on servers can miss the power, cooling or physical monitoring equipment on which those servers depend. Determine appropriate service arrangements using competent advice and the equipment's role and condition.

Assign an owner who can act on overdue work and recurring faults. A maintenance calendar should lead to a decision when a task is deferred, not quietly convert an overdue item into an accepted condition. Consider how the equipment will remain protected while waiting for parts or specialist support, and who can approve any temporary arrangement.

Authorise the work and the access it needs

Before maintenance, define the task, responsible provider and permitted access. A supplier may need physical access, remote access or information about the system. Limit that access to the work and clarify how it will end. Appropriate confidentiality and supplier arrangements support the decision, but do not replace supervision or technical control where these are necessary.

Remote maintenance needs an authorised route with suitable authentication, monitoring and termination arrangements. Do not leave a temporary support method available indefinitely because the repair succeeded. Changes introduced during maintenance should reach the people responsible for configuration, service operation and security.

Why controlled equipment maintenance matters to the business

Equipment that is not maintained fails at the worst time, and equipment that is maintained carelessly can leak. A technician with unrestricted access may see information, remove a storage component or leave the device in an unknown state. Planned maintenance keeps services available and extends equipment life, and disciplined control of the work protects confidentiality and integrity. Customers depend on your equipment staying reliable, and often on your suppliers behaving properly. At audit, maintenance is tested through records and sampling, so evidence that work was authorised, completed and followed up shows that equipment support is under control rather than left to goodwill.

How to implement A.7.13

Treat maintenance as both a reliability task and an access decision. Keep the scheme proportionate so that low-risk equipment does not absorb as much effort as critical items. Include equipment held at remote or unmanned sites, which is often serviced less carefully.

1. List the equipment supporting information processing, including power, cooling and monitoring systems, and note its condition.
2. Define maintenance needs from supplier information, competent advice and the role the equipment plays.
3. Assign an owner who can act when work is overdue or faults recur, and require a decision when tasks are deferred.
4. Authorise each job in advance, stating the task, the provider and the access and information they may use.
5. Agree confidentiality terms with suppliers and decide how remote access is granted and ended.
6. Plan how equipment is protected while awaiting parts, and who approves temporary arrangements.
7. Check equipment after servicing and before return to service, and keep records of work done.

Illustrative BPO example: a printer sent for repair

Illustrative manufacturing example: an emergency remote service session

A hypothetical manufacturer asks a support provider to diagnose a production-support computer outside ordinary working hours. The provider requests remote access, and the plant is under pressure to restore operations quickly. A familiar engineer's request is treated initially as sufficient authorisation.

The responsible owner confirms the task and approves the established support route. Relevant access is controlled for the session, necessary changes are recorded and the provider's temporary permission is removed afterward. The team verifies the affected function and checks that the authorised configuration remains appropriate. The example illustrates a controlled emergency route, not a reason to postpone protection until business pressure has passed.

Verify the return to operation

Completion needs more than confirmation that a technician attended. Determine appropriate checks for function, condition and possible unauthorised changes before equipment returns to normal service. The depth of verification depends on what was done and what the equipment supports. A routine physical repair and a replacement of a critical component may need different evidence.

If equipment cannot be repaired or is replaced, move it into the appropriate disposal or reuse process. A rejected component can retain information even when it no longer functions normally. Avoid allowing a service provider to dispose of it under an undefined default arrangement.

Evidence that supports continuing confidence

Common nonconformities with A.7.13

Findings usually concern maintenance that is either missing or uncontrolled. The theme is that maintenance was arranged but not governed, which shows up quickly when an auditor asks to follow one job from request to completion.

• Overdue servicing quietly accepted with no recorded decision.
• Supplier technicians given broad physical or remote access with no defined task.
• Maintenance programme covering servers but not supporting power or cooling equipment.
• No check that equipment returned to service in a secure and correct state.
• Storage components removed during repair with no record of where they went.