Equipment is to be properly maintained so that information stays available, intact and confidential. Purpose: keep poor upkeep from causing information or assets to be lost, stolen, harmed or compromised, or from stopping operations. Guidance: consider servicing equipment at the intervals and to the specifications the supplier recommends; running and monitoring the organization's own maintenance programme; allowing only authorized maintenance staff to repair or service equipment; recording every suspected or actual fault and all preventive and corrective maintenance; applying suitable controls when maintenance is scheduled, depending on whether it is done by on-site staff or outsiders, with maintenance staff bound by an appropriate confidentiality agreement; supervising maintenance personnel on site; authorizing and controlling remote maintenance access; applying off-premises protections (7.9) when equipment holding information leaves for repair; meeting any maintenance requirements set by insurers; inspecting equipment before it returns to service to confirm it has not been tampered with and works correctly; and applying secure disposal or reuse measures (7.14) if the equipment is going to be scrapped. In this control, equipment covers processing components, UPS units and batteries, generators, alternators and converters, intruder detection and alarm systems, smoke and fire equipment, air conditioning and lifts.
This control maps to 55 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 7.13 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 55 it maps to, and the evidence behind each claim, over MCP and REST.