ISO 27001:2022 Annex A 7.13 – Equipment Maintenance

• See ISO 27002:2022 Control 7.13 for more information.
• See ISO 27001:2013 Annex A 11.2.4 for more information.

ISO 27001:2022 Annex A 7.13 – Secure Equipment Maintenance Explained

ISO 27001:2022 Annex A 7.13 is concerned with establishing and implementing appropriate procedures and measures for the proper maintenance of equipment to ensure that the information assets stored on this equipment will not be compromised.

For the storage, use, and transfer of information assets, IT equipment such as servers, laptops, network devices, and printers are essential. A failure to maintain this equipment according to its specifications and environmental risks may result in poor quality and performance degradation. Due to this lack of maintenance, the integrity, confidentiality, and availability of information assets may be compromised.

For example, an organisation may not realise its disk space is full if it fails to perform regular maintenance on its server hardware. The server may lose data transmitted to or from it as a result.

What Is The Purpose of ISO 27001:2022 Annex A 7.13?

ISO 27001:2022 Annex A 7.13 describes how to conduct proper maintenance on equipment used to store information assets based on technical measures and procedures.

Measures and procedures are put in place to ensure that information assets are protected from loss, damage, and unauthorised access, among other concerns.

ISO 27001:2022 Annex A 7.13 describes a preventive type of control under which organisations need to take an active approach to the maintenance of their equipment.

Who Has Ownership of Annex A 7.13?

Compliance with Annex A 7.13 states that an equipment list should be prepared, a risk assessment should be conducted based on environmental factors and the specifications of the product, as well as establishing and implementing appropriate procedures and measures to ensure proper maintenance of the equipment.

The Information Security Manager should be responsible for ensuring compliance with ISO 27001:2022 Annex A 7.13 despite the importance of individuals handling this equipment on a daily basis.

General Guidance on ISO 27001:2022 Annex A 7.13 for Compliance

Annex A 7.13 provides organisations with 11 specific recommendations:

1. Following the equipment manufacturer’s specifications regarding maintenance procedures, such as recommended service intervals, is recommended.
2. For all equipment, organisations should establish and implement a maintenance programme.
3. Maintaining or repairing equipment should only be performed by authorised personnel or authorised third parties.
4. All equipment malfunctions and faults should be recorded by organisations. Furthermore, all maintenance activities on said equipment should also be recorded.
5. It is essential for organisations to apply suitable maintenance procedures regardless of whether maintenance is performed by their employees or by third parties. Furthermore, confidentiality agreements should be signed by the relevant personnel.
6. All maintenance personnel should be supervised at all times.
7. Access and authorisation procedures should be strictly enforced for remote maintenance work.
8. Organisations should apply appropriate security measures in accordance with Annex A 7.9 whenever equipment is removed from premises for maintenance.
9. Maintenance requirements imposed by insurance providers should be adhered to by organisations.
10. To ensure that equipment has not been tampered with and functions properly, companies should inspect it after maintenance.
11. Organisations should establish and implement suitable measures and procedures for disposing of or reusing equipment under Annex A 7.14.

Supplementary Guidance on Annex A 7.13

ISO 27001:2022 Annex A 7.13 states that the following are considered equipment and fall under the scope of Annex A 7.13:

• Power converters.
• Air conditioners.
• Similar assets.
• Technical components of information processing facilities.
• Batteries.
• Fire extinguishers.
• Lifts.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 7.13 replaces ISO 27001:2013 Annex A 11.2.4 (‘Equipment Maintenance’).

The ISO 27001:2022 Version Contains More Comprehensive Requirements

Compared to the ISO 27001:2013 version, Annex A 7.13 in the 2022 Version sets out more comprehensive requirements.

While the ISO 27001:2013 version only listed six specific requirements, ISO 27001:2022 Annex A 7.13 contains 11 requirements.

Annex A 7.13 introduces the five following requirements, which were not addressed in the ISO 27001:2013 version:

1. For all equipment, organisations should establish and implement a maintenance programme.
2. All maintenance personnel should be supervised at all times.
3. Maintenance work performed remotely should be subject to strict access and authorisation controls.
4. According to Annex A 7.14, organisations should establish and implement appropriate measures and procedures for disposing of or reusing equipment.
5. Organisations should apply appropriate security measures in accordance with Annex A 7.9 whenever equipment is removed from premises for maintenance.

The ISO 27001:2022 Revision Defines ‘Equipment’

The Supplementary Guidance defines ‘Equipment’ in Annex A 7.13. In contrast, the ISO 27001:2013 version did not refer to the meaning of ‘Equipment’.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

You can do the following with ISMS.online:

• Make sure your processes are documented. Using this intuitive interface, you can document your processes without installing any software.
• Assess risks more efficiently by automating the process.
• With online reports and checklists, you can easily demonstrate compliance.
• While working toward certification, keep a record of your progress.

ISMS.online offers a full range of features to help organisations and businesses achieve compliance with the standard ISO 27001:2022.

Get in touch with us today to schedule a demo.