ISO 27001 A.7.13: Equipment maintenance

Set up a preventive maintenance programme for all information processing equipment. Define schedules based on manufacturer recommendations, how critical the equipment is, and operating conditions. Servers, network gear, UPS systems, and cooling equipment need more frequent attention than desktop hardware. Build security into your maintenance procedures. Before any maintenance: verify the identity and authorisation of the person doing the work, especially third-party contractors. Escort them in secure areas if they do not hold appropriate clearance. Back up data on the equipment before maintenance that might affect storage or configurations. Remove sensitive data from any equipment going off-site for repair. During maintenance: supervise work on critical equipment. Log everything - who did the work, what was done, parts replaced, configuration changes made. Make sure the maintenance does not introduce security problems like default passwords, unauthorised software, or exposed management interfaces. After maintenance: verify the equipment works correctly. Confirm security configurations are intact or have been restored. Check that patches and updates are still in place. Test any security controls that might have been affected. Update the asset register with changes like replaced components or firmware updates. For equipment sent off-site: remove or encrypt storage media containing sensitive data before shipping. Get confidentiality agreements from the maintenance provider. Track the equipment throughout the process. When it comes back, check for unauthorised modifications and re-verify security configurations before returning it to production. Keep detailed maintenance records. Document every activity, parts replacement, and provider involved. Use the records to spot recurring issues, plan future maintenance, and make informed decisions about when to replace rather than repair.