What the auditor wants to verify
Audit objective
Verify that equipment is maintained according to defined requirements and that maintenance protects availability, integrity, and confidentiality.
Evidence to request
| Evidence | Purpose |
|---|---|
| Equipment maintenance register | Shows maintenance requirements are known |
| Maintenance procedure | Shows the process is defined |
| Work orders/service records | Shows maintenance occurred |
| Fault and rectification logs | Shows defects are reported and resolved |
| Maintainer authorization records | Shows maintainers are approved |
| Escort/access records | Shows external maintenance access is controlled |
| Post-maintenance test/tamper records | Shows equipment is verified after work |
Strong evidence
- Maintenance is scheduled and recorded.
- Faults and repairs are tracked.
- Maintainers are authorized and qualified.
- External maintainers are escorted where required.
- Confidential information is protected during maintenance.
- Post-maintenance checks detect unauthorized change or tampering.
Weak evidence
- Maintenance happens only after failure.
- No fault reporting mechanism exists.
- External maintainers work unsupervised.
- Sensitive data is accessible during maintenance.
- No post-maintenance verification occurs.
Sample interview questions
- How are maintenance intervals defined?
- Who is authorized to maintain equipment?
- How are external maintainers supervised?
- How is confidential information protected during maintenance?
- What checks occur after maintenance?
Common nonconformities
- Missing maintenance records.
- Faults not logged or tracked.
- Unauthorized maintenance access.
- Confidential data exposed during repair.
- No tamper or unauthorized modification checks.
Related notes
- Iso27001
- ISO27002
- Audit
- Evidence
- A7 13
Note Metadata
Aliases: A.7.13 Evidence
Source: 04 Audit Evidence Packs/A.7.13 Audit Evidence Pack.md
Graph-sourced resources
Templates and evidence
Auditor evidence packs
Evidence collections and audit-facing verification material.