What it asks for. Maintain equipment correctly so that information remains available, intact and confidential.
In practice. Maintenance follows supplier recommended intervals and specifications and is carried out only by authorised personnel. Records are kept of all maintenance and of suspected or actual faults. When equipment is serviced off site or by external parties, information on it is protected, for example by removing or encrypting storage, and maintenance personnel are supervised where needed. Equipment is checked after maintenance before returning to service. Evidence includes maintenance schedules, service records and contract terms with maintenance providers.
Common gaps. Maintenance is often reactive rather than scheduled, particularly for supporting equipment such as UPS units and cooling. Devices are sent away for repair with unencrypted disks still inside and no record of what data they held.