Management of periodic maintenance
Maintenance timeliness is measured per completed event.
What the published 2016 guidance says
Maintenance timeliness is measured per completed event. For each event, subtract the scheduled date from the actual date. The organization sets the target, for example examining causes when the average delay passes three days, keeping the completion ratio above 0.9, and holding the delay trend flat or near zero. Evidence is the scheduled and actual dates and the counts of planned and completed events. It is collected quarterly and reported annually. The system administrator owns it, security staff collect, and the security and technology managers are clients. A line chart shows the average delay with the number of systems in scope.
What it means in practice
Maintenance delay is easy to collect and easy to ignore. Measure the delay per completed event and the completion ratio, then show the trend. A stable average with a long tail is a different problem from a rising average, and the chart should let the reader see which one it is.
Status of this record. For B.21, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the maintenance schedule and the completion records. Calculate the delay per event and the completion ratio. Report the average and the distribution. Review the cause when the average or the tail moves.
Evidence an assessor asks for
- Physical securityMaintenance schedule and completion records with dates
- Equipment maintenanceAverage delay and completion ratio per period
The question an assessor will ask
An assessor will ask for maintenance schedule and completion records with dates. The test for B.21 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Maintenance performed by a supplier with no completion date recorded
- Schedule rewritten after the fact so no delay ever appears
Before the next review
Before the next review, test this against one live record: maintenance performed by a supplier with no completion date recorded.
What to check when the revision publishes
When DIS 27004 is published, compare the B.21 Management of periodic maintenance record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.