ISO 27001 Annex A 7.7 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 7.7 Clear desk and clear screen

1. Equipment Maintenance Inventory Verified

Verification Criteria: A master register exists identifying all equipment that requires periodic maintenance to ensure continued availability and integrity.

Required Evidence: Asset Register containing maintenance metadata (e.g. last service date, next service date, and service provider).

Pass/Fail Test: If critical infrastructure (e.g. UPS or HVAC) is missing from the maintenance tracking system, mark as Non-Compliant.

2. Manufacturer Specifications Alignment Confirmed

Verification Criteria: Maintenance intervals and procedures are aligned with the manufacturer’s recommendations and technical specifications.

Required Evidence: Comparison report between manufacturer manuals and the organisation’s internal Maintenance Schedule.

Pass/Fail Test: If maintenance is performed less frequently than the manufacturer-recommended interval without a documented risk-based justification, mark as Non-Compliant.

3. Preventive Maintenance Execution Records Present

Verification Criteria: Documented evidence confirms that preventive maintenance tasks have been completed according to the established schedule.

Required Evidence: Signed service reports, job sheets, or maintenance logs from internal technicians or third-party contractors.

Pass/Fail Test: If more than 10% of scheduled maintenance tasks for the current period are overdue without an extension or explanation, mark as Non-Compliant.

4. Corrective Maintenance Log Integrity Validated

Verification Criteria: All equipment failures and subsequent repairs are logged, including root cause analysis and details of parts replaced.

Required Evidence: Corrective Maintenance Log or ticketing system export showing resolution details for hardware failures.

Pass/Fail Test: If a major equipment failure occurred but no record exists of the repair or the verification of the fix, mark as Non-Compliant.

5. Maintenance Personnel Authorisation Verified

Verification Criteria: Only authorised and qualified personnel (internal or external) are permitted to perform maintenance on sensitive equipment.

Required Evidence: Approved vendor list for maintenance services and training/certification records for internal maintenance staff.

Pass/Fail Test: If maintenance was performed on a production server or UPS by an unvetted or unapproved third party, mark as Non-Compliant.

6. Secure Handling of Equipment During Maintenance Confirmed

Verification Criteria: Controls are in place to prevent unauthorised access to data or systems when equipment is being serviced by external parties.

Required Evidence: Visitor logs showing external engineers are escorted; evidence of disk removal or encryption for off-site repairs.

Pass/Fail Test: If equipment containing sensitive data was sent off-site for repair without a signed data processing agreement or disk wiping/removal, mark as Non-Compliant.

7. Redundant System Functional Testing Validated

Verification Criteria: Redundant systems (e.g. backup generators, secondary cooling) are tested under load during maintenance to ensure failover capability.

Required Evidence: Load test logs for generators or failover drill reports for secondary environmental controls.

Pass/Fail Test: If a generator is maintained but never “switched on” or load-tested to verify it can support the data centre, mark as Non-Compliant.

8. Maintenance Tool Calibration Records Verified

Verification Criteria: Tools used for measuring or testing equipment (e.g. multimeters, thermal sensors) are calibrated against national standards.

Required Evidence: Valid Calibration Certificates for tools used in the maintenance of critical infrastructure.

Pass/Fail Test: If maintenance decisions are made based on uncalibrated or expired test equipment, mark as Non-Compliant.

9. Maintenance-Related Security Incident Linkage Identified

Verification Criteria: Any security breaches or anomalies discovered during maintenance activities are formally reported as security incidents.

Required Evidence: Cross-reference between maintenance logs and the Information Security Incident Register.

Pass/Fail Test: If a technician discovers evidence of tampering during maintenance but no incident report was raised, mark as Non-Compliant.

10. Management Review of Maintenance Trends Confirmed

Verification Criteria: Maintenance reports and equipment uptime metrics are reviewed by management to determine if equipment replacement is necessary.

Required Evidence: Management Review Meeting (MRM) minutes showing analysis of equipment lifecycle and maintenance costs.

Pass/Fail Test: If equipment consistently fails and requires excessive corrective maintenance without a management plan for replacement, mark as Non-Compliant.

About the author