ISO 27001:2022 Annex A Control 7.13

Equipment Maintenance

Book a demo

wide,angle,view,of,busy,design,office,with,workers,at

ISO 27001:2022 Annex A 7.13 is concerned with establishing and implementing appropriate procedures and measures for the proper maintenance of equipment to ensure that the information assets stored on this equipment will not be compromised.

For the storage, use, and transfer of information assets, IT equipment such as servers, laptops, network devices, and printers are essential. A failure to maintain this equipment according to its specifications and environmental risks may result in poor quality and performance degradation. Due to this lack of maintenance, the integrity, confidentiality, and availability of information assets may be compromised.

For example, an organisation may not realise its disk space is full if it fails to perform regular maintenance on its server hardware. The server may lose data transmitted to or from it as a result.

What Is The Purpose of ISO 27001:2022 Annex A 7.13?

ISO 27001:2022 Annex A 7.13 describes how to conduct proper maintenance on equipment used to store information assets based on technical measures and procedures.

Measures and procedures are put in place to ensure that information assets are protected from loss, damage, and unauthorised access, among other concerns.

ISO 27001:2022 Annex A 7.13 describes a preventive type of control under which organisations need to take an active approach to the maintenance of their equipment.

Who Has Ownership of Annex A 7.13?

Compliance with Annex A 7.13 states that an equipment list should be prepared, a risk assessment should be conducted based on environmental factors and the specifications of the product, as well as establishing and implementing appropriate procedures and measures to ensure proper maintenance of the equipment.

The Information Security Manager should be responsible for ensuring compliance with ISO 27001:2022 Annex A 7.13 despite the importance of individuals handling this equipment on a daily basis.

Jump to Topic
Trusted by companies everywhere
  • Simple and easy to use
  • Designed for ISO 27001 success
  • Saves you time and money
Book your demo
img

General Guidance on ISO 27001:2022 Annex A 7.13 for Compliance

Annex A 7.13 provides organisations with 11 specific recommendations:

  1. Following the equipment manufacturer’s specifications regarding maintenance procedures, such as recommended service intervals, is recommended.

  2. For all equipment, organisations should establish and implement a maintenance programme.

  3. Maintaining or repairing equipment should only be performed by authorised personnel or authorised third parties.

  4. All equipment malfunctions and faults should be recorded by organisations. Furthermore, all maintenance activities on said equipment should also be recorded.

  5. It is essential for organisations to apply suitable maintenance procedures regardless of whether maintenance is performed by their employees or by third parties. Furthermore, confidentiality agreements should be signed by the relevant personnel.

  6. All maintenance personnel should be supervised at all times.

  7. Access and authorisation procedures should be strictly enforced for remote maintenance work.

  8. Organisations should apply appropriate security measures in accordance with Annex A 7.9 whenever equipment is removed from premises for maintenance.

  9. Maintenance requirements imposed by insurance providers should be adhered to by organisations.

  10. To ensure that equipment has not been tampered with and functions properly, companies should inspect it after maintenance.

  11. Organisations should establish and implement suitable measures and procedures for disposing of or reusing equipment under Annex A 7.14.

Supplementary Guidance on Annex A 7.13

ISO 27001:2022 Annex A 7.13 states that the following are considered equipment and fall under the scope of Annex A 7.13:

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 7.13 replaces ISO 27001:2013 Annex A 11.2.4 (‘Equipment Maintenance’).

The ISO 27001:2022 Version Contains More Comprehensive Requirements

Compared to the ISO 27001:2013 version, Annex A 7.13 in the 2022 Version sets out more comprehensive requirements.

While the ISO 27001:2013 version only listed six specific requirements, ISO 27001:2022 Annex A 7.13 contains 11 requirements.

Annex A 7.13 introduces the five following requirements, which were not addressed in the ISO 27001:2013 version:

  1. For all equipment, organisations should establish and implement a maintenance programme.

  2. All maintenance personnel should be supervised at all times.

  3. Maintenance work performed remotely should be subject to strict access and authorisation controls.

  4. According to Annex A 7.14, organisations should establish and implement appropriate measures and procedures for disposing of or reusing equipment.

  5. Organisations should apply appropriate security measures in accordance with Annex A 7.9 whenever equipment is removed from premises for maintenance.

The ISO 27001:2022 Revision Defines ‘Equipment’

The Supplementary Guidance defines ‘Equipment’ in Annex A 7.13. In contrast, the ISO 27001:2013 version did not refer to the meaning of ‘Equipment’.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

ISO 27001:2022 Organisational Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Organisational ControlsAnnex A 5.1Annex A 5.1.1
Annex A 5.1.2		Policies for Information Security
Organisational ControlsAnnex A 5.2Annex A 6.1.1Information Security Roles and Responsibilities
Organisational ControlsAnnex A 5.3Annex A 6.1.2Segregation of Duties
Organisational ControlsAnnex A 5.4Annex A 7.2.1Management Responsibilities
Organisational ControlsAnnex A 5.5Annex A 6.1.3Contact With Authorities
Organisational ControlsAnnex A 5.6Annex A 6.1.4Contact With Special Interest Groups
Organisational ControlsAnnex A 5.7NEWThreat Intelligence
Organisational ControlsAnnex A 5.8Annex A 6.1.5
Annex A 14.1.1		Information Security in Project Management
Organisational ControlsAnnex A 5.9Annex A 8.1.1
Annex A 8.1.2		Inventory of Information and Other Associated Assets
Organisational ControlsAnnex A 5.10Annex A 8.1.3
Annex A 8.2.3		Acceptable Use of Information and Other Associated Assets
Organisational ControlsAnnex A 5.11Annex A 8.1.4Return of Assets
Organisational ControlsAnnex A 5.12Annex A 8.2.1Classification of Information
Organisational ControlsAnnex A 5.13Annex A 8.2.2Labelling of Information
Organisational ControlsAnnex A 5.14Annex A 13.2.1
Annex A 13.2.2
Annex A 13.2.3		Information Transfer
Organisational ControlsAnnex A 5.15Annex A 9.1.1
Annex A 9.1.2		Access Control
Organisational ControlsAnnex A 5.16Annex A 9.2.1Identity Management
Organisational ControlsAnnex A 5.17Annex A 9.2.4
Annex A 9.3.1
Annex A 9.4.3		Authentication Information
Organisational ControlsAnnex A 5.18Annex A 9.2.2
Annex A 9.2.5
Annex A 9.2.6		Access Rights
Organisational ControlsAnnex A 5.19Annex A 15.1.1Information Security in Supplier Relationships
Organisational ControlsAnnex A 5.20Annex A 15.1.2Addressing Information Security Within Supplier Agreements
Organisational ControlsAnnex A 5.21Annex A 15.1.3Managing Information Security in the ICT Supply Chain
Organisational ControlsAnnex A 5.22Annex A 15.2.1
Annex A 15.2.2		Monitoring, Review and Change Management of Supplier Services
Organisational ControlsAnnex A 5.23NEWInformation Security for Use of Cloud Services
Organisational ControlsAnnex A 5.24Annex A 16.1.1Information Security Incident Management Planning and Preparation
Organisational ControlsAnnex A 5.25Annex A 16.1.4Assessment and Decision on Information Security Events
Organisational ControlsAnnex A 5.26Annex A 16.1.5Response to Information Security Incidents
Organisational ControlsAnnex A 5.27Annex A 16.1.6Learning From Information Security Incidents
Organisational ControlsAnnex A 5.28Annex A 16.1.7Collection of Evidence
Organisational ControlsAnnex A 5.29Annex A 17.1.1
Annex A 17.1.2
Annex A 17.1.3		Information Security During Disruption
Organisational ControlsAnnex A 5.30NEWICT Readiness for Business Continuity
Organisational ControlsAnnex A 5.31Annex A 18.1.1
Annex A 18.1.5		Legal, Statutory, Regulatory and Contractual Requirements
Organisational ControlsAnnex A 5.32Annex A 18.1.2Intellectual Property Rights
Organisational ControlsAnnex A 5.33Annex A 18.1.3Protection of Records
Organisational ControlsAnnex A 5.34 Annex A 18.1.4Privacy and Protection of PII
Organisational ControlsAnnex A 5.35Annex A 18.2.1Independent Review of Information Security
Organisational ControlsAnnex A 5.36Annex A 18.2.2
Annex A 18.2.3		Compliance With Policies, Rules and Standards for Information Security
Organisational ControlsAnnex A 5.37Annex A 12.1.1Documented Operating Procedures

ISO 27001:2022 People Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
People ControlsAnnex A 6.1Annex A 7.1.1Screening
People ControlsAnnex A 6.2Annex A 7.1.2Terms and Conditions of Employment
People ControlsAnnex A 6.3Annex A 7.2.2Information Security Awareness, Education and Training
People ControlsAnnex A 6.4Annex A 7.2.3Disciplinary Process
People ControlsAnnex A 6.5Annex A 7.3.1Responsibilities After Termination or Change of Employment
People ControlsAnnex A 6.6Annex A 13.2.4Confidentiality or Non-Disclosure Agreements
People ControlsAnnex A 6.7Annex A 6.2.2Remote Working
People ControlsAnnex A 6.8Annex A 16.1.2
Annex A 16.1.3		Information Security Event Reporting

ISO 27001:2022 Physical Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Physical ControlsAnnex A 7.1Annex A 11.1.1Physical Security Perimeters
Physical ControlsAnnex A 7.2Annex A 11.1.2
Annex A 11.1.6		Physical Entry
Physical ControlsAnnex A 7.3Annex A 11.1.3Securing Offices, Rooms and Facilities
Physical ControlsAnnex A 7.4NEWPhysical Security Monitoring
Physical ControlsAnnex A 7.5Annex A 11.1.4Protecting Against Physical and Environmental Threats
Physical ControlsAnnex A 7.6Annex A 11.1.5Working In Secure Areas
Physical ControlsAnnex A 7.7Annex A 11.2.9Clear Desk and Clear Screen
Physical ControlsAnnex A 7.8Annex A 11.2.1Equipment Siting and Protection
Physical ControlsAnnex A 7.9Annex A 11.2.6Security of Assets Off-Premises
Physical ControlsAnnex A 7.10Annex A 8.3.1
Annex A 8.3.2
Annex A 8.3.3
 Annex A 11.2.5		Storage Media
Physical ControlsAnnex A 7.11Annex A 11.2.2Supporting Utilities
Physical ControlsAnnex A 7.12Annex A 11.2.3Cabling Security
Physical ControlsAnnex A 7.13Annex A 11.2.4Equipment Maintenance
Physical ControlsAnnex A 7.14Annex A 11.2.7Secure Disposal or Re-Use of Equipment

ISO 27001:2022 Technological Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Technological ControlsAnnex A 8.1Annex A 6.2.1
Annex A 11.2.8		User Endpoint Devices
Technological ControlsAnnex A 8.2Annex A 9.2.3Privileged Access Rights
Technological ControlsAnnex A 8.3Annex A 9.4.1Information Access Restriction
Technological ControlsAnnex A 8.4Annex A 9.4.5Access to Source Code
Technological ControlsAnnex A 8.5Annex A 9.4.2Secure Authentication
Technological ControlsAnnex A 8.6Annex A 12.1.3Capacity Management
Technological ControlsAnnex A 8.7Annex A 12.2.1Protection Against Malware
Technological ControlsAnnex A 8.8Annex A 12.6.1
Annex A 18.2.3		Management of Technical Vulnerabilities
Technological ControlsAnnex A 8.9NEWConfiguration Management
Technological ControlsAnnex A 8.10NEWInformation Deletion
Technological ControlsAnnex A 8.11NEWData Masking
Technological ControlsAnnex A 8.12NEWData Leakage Prevention
Technological ControlsAnnex A 8.13Annex A 12.3.1Information Backup
Technological ControlsAnnex A 8.14Annex A 17.2.1Redundancy of Information Processing Facilities
Technological ControlsAnnex A 8.15Annex A 12.4.1
Annex A 12.4.2
Annex A 12.4.3		Logging
Technological ControlsAnnex A 8.16NEWMonitoring Activities
Technological ControlsAnnex A 8.17Annex A 12.4.4Clock Synchronization
Technological ControlsAnnex A 8.18Annex A 9.4.4Use of Privileged Utility Programs
Technological ControlsAnnex A 8.19Annex A 12.5.1
Annex A 12.6.2		Installation of Software on Operational Systems
Technological ControlsAnnex A 8.20Annex A 13.1.1Networks Security
Technological ControlsAnnex A 8.21Annex A 13.1.2Security of Network Services
Technological ControlsAnnex A 8.22Annex A 13.1.3Segregation of Networks
Technological ControlsAnnex A 8.23NEWWeb filtering
Technological ControlsAnnex A 8.24Annex A 10.1.1
Annex A 10.1.2		Use of Cryptography
Technological ControlsAnnex A 8.25Annex A 14.2.1Secure Development Life Cycle
Technological ControlsAnnex A 8.26Annex A 14.1.2
Annex A 14.1.3		Application Security Requirements
Technological ControlsAnnex A 8.27Annex A 14.2.5Secure System Architecture and Engineering Principles
Technological ControlsAnnex A 8.28NEWSecure Coding
Technological ControlsAnnex A 8.29Annex A 14.2.8
Annex A 14.2.9		Security Testing in Development and Acceptance
Technological ControlsAnnex A 8.30Annex A 14.2.7Outsourced Development
Technological ControlsAnnex A 8.31Annex A 12.1.4
Annex A 14.2.6		Separation of Development, Test and Production Environments
Technological ControlsAnnex A 8.32Annex A 12.1.2
Annex A 14.2.2
Annex A 14.2.3
Annex A 14.2.4		Change Management
Technological ControlsAnnex A 8.33Annex A 14.3.1Test Information
Technological ControlsAnnex A 8.34Annex A 12.7.1Protection of Information Systems During Audit Testing

How ISMS.online Help

You can do the following with ISMS.online:

  • Make sure your processes are documented. Using this intuitive interface, you can document your processes without installing any software.

  • Assess risks more efficiently by automating the process.

  • With online reports and checklists, you can easily demonstrate compliance.

  • While working toward certification, keep a record of your progress.

ISMS.online offers a full range of features to help organisations and businesses achieve compliance with the standard ISO 27001:2022.

Get in touch with us today to schedule a demo.

See ISMS.online
in action

Book a tailored hands-on session
based on your needs and goals
Book your demo

Unsure whether to build or buy?

Discover the best way to achieve ISMS success

Get your free guide

ISMS.online now supports ISO 42001 - the world's first AI Management System. Click to find out more