A.7.13
Equipment maintenance
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
The purpose is to inspect and service equipment that stores, processes, or transmits information in line with the manufacturer's recommended specifications and the organization's operational needs, so as to prevent loss of information availability caused by malfunction, failure, or performance degradation. Maintenance covers both planned preventive servicing and repair or replacement after a fault, and it should be controlled so that only qualified and authorized personnel perform it. In particular, when servicing is carried out by external technicians, remotely, or by taking equipment off site for repair, stored information must be protected from exposure or alteration, so that confidentiality and integrity are assured alongside availability.
Key checkpoints
- Are maintenance targets, cycles, and owners defined and followed for each item, based on the asset inventory and the manufacturer's recommended specifications?
- Is maintenance performed only by qualified and authorized personnel, and for external technicians, are escort/supervision and limited access scope applied?
- Are maintenance records (date and time, performer, actions taken, faults found, parts replaced) kept and retained?
- For external/remote servicing and offsite repair, are safeguards against exposure/alteration (media removal, deletion/encryption, restricted access, NDAs, session records) distinguished from backups for recovery?
- Are maintenance contract and SLA terms, warranty conditions, and relevant legal requirements (electrical, fire, and similar safety inspections) defined and verified for compliance?
- After maintenance, is the equipment rechecked to confirm normal operation and that security settings (permissions, patches, configuration) have not been degraded?
Implementation guidance
- Define maintenance targets, preventive servicing cycles, and owners based on the asset inventory, and build the maintenance plan reflecting manufacturer specifications and operational criticality.
- Separate preventive servicing (periodic inspection, consumable and part replacement, firmware checks) from corrective servicing (fault response, repair, replacement), and set procedures and approval criteria for each.
- Restrict maintenance to qualified and authorized personnel, and for external technicians apply escort/supervision, minimized access scope, and before-and-after checks.
- Before external servicing or off-site repair, back up and then remove sensitive information or detach the storage media; where that is not possible, protect it with encryption and a non-disclosure agreement (NDA).
- Apply prior approval, least-privilege accounts, encrypted connections, and session logging and monitoring to remote maintenance, and revoke access rights when the work ends.
- Include security requirements in maintenance contracts and SLAs (warranty scope, response time, information protection obligations, subcontracting controls), and review compliance periodically.
- After maintenance completes, verify that the equipment operates normally and that security configuration, patches, and access rights are intact, and record and retain the results and history.
Evidence
- Inventory of equipment subject to maintenance and the maintenance plan or schedule (including preventive servicing cycles)
- Maintenance logs, work orders, and inspection checklists (performer, actions taken, parts replaced)
- Maintenance contracts and SLAs, warranty documents, and non-disclosure agreements (NDAs) with external technicians
- Entry/escort records for external technicians and approval records for access scope
- Approval records and session logs for remote maintenance
- Records confirming data backup and removal before off-site repair, and recheck records of normal operation and security settings after maintenance
Nonconformity examples
- No maintenance cycle is defined for critical equipment, or preventive servicing is chronically delayed, leaving the risk of failure or performance degradation unmanaged.
- Maintenance history is not recorded, or actions taken and parts replaced are omitted, so servicing cannot be traced.
- External technicians access equipment without escort/supervision, creating a risk that stored sensitive information is exposed.
- Equipment sent offsite for repair retains sensitive data without deletion, media removal, or suitable encryption/access restrictions, leaving disclosure risk untreated.
- Remote maintenance uses shared accounts or leaves sessions unlogged, so it is impossible to confirm who did what.
- Equipment whose warranty or SLA has expired is left in place without renewal or replacement, making timely recovery difficult when a fault occurs.