All 93 controls · Physical controls
Control 7.13
Equipment maintenance
What ISO/IEC 27002:2022 control 7.13 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Equipment is to be properly maintained so that information stays available, intact and confidential. Purpose: keep poor upkeep from causing information or assets to be lost, stolen, harmed or compromised, or from stopping operations. Guidance: consider servicing equipment at the intervals and to the specifications the supplier recommends; running and monitoring the organization's own maintenance programme; allowing only authorized maintenance staff to repair or service equipment; recording every suspected or actual fault and all preventive and corrective maintenance; applying suitable controls when maintenance is scheduled, depending on whether it is done by on-site staff or outsiders, with maintenance staff bound by an appropriate confidentiality agreement; supervising maintenance personnel on site; authorizing and controlling remote maintenance access; applying off-premises protections (7.9) when equipment holding information leaves for repair; meeting any maintenance requirements set by insurers; inspecting equipment before it returns to service to confirm it has not been tampered with and works correctly; and applying secure disposal or reuse measures (7.14) if the equipment is going to be scrapped. In this control, equipment covers processing components, UPS units and batteries, generators, alternators and converters, intruder detection and alarm systems, smoke and fire equipment, air conditioning and lifts.
Purpose in the standard’s terms, in our words: Prevents loss, compromise or operational interruption caused by lack of equipment maintenance.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Asset management; Protection, Resilience.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | ProtectionResilience |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- A maintenance programme and schedule aligned with supplier-recommended intervals and specifications, covering IT, power, fire, alarm and HVAC equipment
- Maintenance and fault logs recording faults and preventive and corrective work
- Lists of authorized maintenance personnel and signed confidentiality agreements
- Supervision records for on-site maintenance and authorization and logging of remote maintenance sessions
- Post-maintenance inspection records confirming no tampering and correct function before return to service
- Evidence insurance-imposed maintenance requirements are met
Where audits commonly find gaps
- Remote maintenance access by vendors is permanently enabled and unmonitored
- Maintenance of fire, alarm and power equipment is not tracked alongside IT equipment
- Equipment returns from repair without any check for tampering
- Engineers work unsupervised in data rooms
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.2.4) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.