---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.7.13"
title: "Equipment maintenance"
theme: Physical
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts: [Protect]
operational_capabilities:
  - Physical_security
  - Asset_management
security_domains:
  - Protection
  - Resilience
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 7.13 Equipment maintenance

  

### Control

  

Equipment should be maintained correctly to ensure availability, integrity and confidentiality of information.

  

### Purpose

  

To prevent loss, damage, theft or compromise of information and other associated assets and interruption to the organization’s operations caused by lack of maintenance.

  

### Guidance

  

The following guidelines for equipment maintenance should be considered:

  

a\) maintaining equipment in accordance with the supplier’s recommended service frequency and specifications;

  

b\) implementing and monitoring of a maintenance programme by the organization;

  

c\) only authorized maintenance personnel carrying out repairs and maintenance on equipment;

  

d\) keeping records of all suspected or actual faults, and of all preventive and corrective maintenance;

  

e\) implementing appropriate controls when equipment is scheduled for maintenance, taking into account whether this maintenance is performed by personnel on site or external to the organization; subjecting the maintenance personnel to a suitable confidentiality agreement;

  

f\) supervising maintenance personnel when carrying out maintenance on site;

  

g\) authorizing and controlling access for remote maintenance;

  

h\) applying security measures for assets off-premises (see [7.9](a-7.9-Security-of-assets-off-premises.md)) if equipment containing information is taken off premises for maintenance;

  

i\) complying with all maintenance requirements imposed by insurance;

  

j\) before putting equipment back into operation after maintenance, inspecting it to ensure that the equipment has not been tampered with and is functioning properly;

  

k\) applying measures for secure disposal or re-use of equipment (see [7.14](a-7.14-Secure-disposal-or-re-use-of-equipment.md)) if it is determined that equipment is to be disposed of.

  

### Other information

  

Equipment includes technical components of information processing facilities, uninterruptible power supply (UPS) and batteries, power generators, power alternators and converters, physical intrusion detection systems and alarms, smoke detectors, fire extinguishers, air conditioning and lifts.