Key takeaways
- Maintain equipment correctly so it stays available and secure.
- Poorly maintained equipment fails at the worst time and may expose data during repair.
- Start here: follow manufacturer maintenance schedules.
Purpose
Maintain equipment correctly so it stays available and secure.
Requirement
Requirement summaryEquipment shall be maintained correctly to ensure availability, integrity and confidentiality of information.
Why it matters
Poorly maintained equipment fails at the worst time and may expose data during repair.
How to implement
- Follow manufacturer maintenance schedules.
- Use authorised maintenance personnel.
- Protect data on equipment sent for repair.
- Keep maintenance records.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.13. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your equipment maintenance process.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.13 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Maintenance records showing equipment is serviced as recommended.
- A list of approved maintenance providers.
- Records showing data was removed or protected before equipment went out for repair.
Things you should be able to show or explain
- Be able to explain how data is protected when equipment is repaired off-site.
How much to show: Three to five key pieces of equipment.
Common mistakes
- No maintenance records.
- Devices sent for repair with data still on them.
- Sending laptops for repair with unencrypted drives.
- No record of maintenance.
- Tip: Keep maintenance records and vendor contracts.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.13 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.13?
Be ready to explain how the control works in your organisation and to provide things like: Your equipment maintenance process…