ISO 27001 Annex A 7.13 Audit Checklist

In this ultimate how to audit guide to ISO 27001 Annex A 7.13 Equipment Maintenance, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.7 Maintenance of Equipment Audit Checklist

Auditing ISO 27001 Annex A 7.7 Maintenance of Equipment is the systematic verification of technical servicing and operational reliability for physical assets. The Primary Implementation Requirement is scheduled preventive care aligned with manufacturer specifications, ensuring the Business Benefit of maximum system uptime and integrity of critical ISMS infrastructure.

This technical verification tool is designed for lead auditors to establish the continuous availability and integrity of physical assets supporting the ISMS. Use this checklist to validate compliance with ISO 27001 Annex A 7.7.

1. Equipment Maintenance Inventory Verified

Verification Criteria: A master register exists identifying all equipment that requires periodic maintenance to ensure continued availability and integrity.

Required Evidence: Asset Register containing maintenance metadata (e.g. last service date, next service date, and service provider).

Pass/Fail Test: If critical infrastructure (e.g. UPS or HVAC) is missing from the maintenance tracking system, mark as Non-Compliant.

2. Manufacturer Specifications Alignment Confirmed

Verification Criteria: Maintenance intervals and procedures are aligned with the manufacturer’s recommendations and technical specifications.

Required Evidence: Comparison report between manufacturer manuals and the organisation’s internal Maintenance Schedule.

Pass/Fail Test: If maintenance is performed less frequently than the manufacturer-recommended interval without a documented risk-based justification, mark as Non-Compliant.

3. Preventive Maintenance Execution Records Present

Verification Criteria: Documented evidence confirms that preventive maintenance tasks have been completed according to the established schedule.

Required Evidence: Signed service reports, job sheets, or maintenance logs from internal technicians or third-party contractors.

Pass/Fail Test: If more than 10% of scheduled maintenance tasks for the current period are overdue without an extension or explanation, mark as Non-Compliant.