Equipment maintenance

Plain-language summary

Maintaining IT and supporting equipment properly — on the manufacturer's schedule, by authorised people, with records — so it stays available and reliable, and so the maintenance itself does not expose the information the equipment holds.

What the clause is really asking

Equipment that fails unexpectedly takes information with it, and maintenance visits are a classic way for data to leave the building. This control asks for maintenance done properly, so equipment keeps working and does not become a route for information to be altered or exposed. The usual requirements: follow the supplier's recommended service intervals and specifications; use only authorised, qualified maintenance people; keep records of all maintenance, including faults and corrective work; control maintenance done on site or remotely, with supervision where needed; remove or protect information before equipment goes off site for repair; and check equipment after maintenance before returning it to service. Scope includes servers, network devices, UPS, generators, cooling, fire suppression, access control and CCTV, and on a plant the industrial PCs and controllers that run production. The misunderstanding is that a warranty or support contract equals maintenance. An ISO 9001 or IATF 16949 plant already has a maintenance management system with preventive schedules and total productive maintenance routines; add IT and security equipment to it rather than build a parallel one.

What auditors look for

Auditors ask for the maintenance schedule for critical IT and supporting equipment and compare it with the manufacturer's recommendations and the records. They sample a UPS, the server room cooling, a firewall and a fire suppression system, and look for service records and the technician's authorisation. They ask how remote maintenance by vendors is controlled and logged, and what happens to data on a device sent for repair. They check for equipment out of vendor support. The hard question: show me the last service on the server room cooling, and who supervised the technician.

Typical evidence

Maintenance schedule for IT and supporting equipment based on manufacturer recommendations; service and repair records; approved maintenance supplier list; supervision and access records for on-site technicians; remote maintenance approvals and access logs; data removal records before off-site repair; post-maintenance checks; list of equipment out of vendor support with the risk decision.

How to comply — recommendations

List critical IT and supporting equipment and load it into the plant's existing maintenance system with service intervals from the manufacturer. Raise planned work orders for UPS, generator, cooling, fire suppression, access control and CCTV as well as servers and network devices. Approve maintenance suppliers and require escorts for technicians in secure areas. Control vendor remote access with time-limited accounts and logging. Wipe or remove drives before equipment leaves for repair. Review equipment past end of support every year and decide whether to replace it or accept the risk.

Common nonconformities

No maintenance schedule for IT or supporting equipment; services missed against manufacturer intervals; maintenance by unauthorised or unvetted technicians; vendor remote access permanently open and unlogged; equipment sent for repair with data on it; no records of maintenance performed; critical equipment beyond vendor support with no plan.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appJob CardsMaintenance job cards, a live machine board and MTTR / MTBF from three honest timestamps.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.