An auditor doesn’t care that your preventive maintenance dashboard is green. The question is whether the record proves the right asset got the required work from an authorized person. A closed work order only counts if it survives that.
Most of the time the proof is scattered. Your parts inventory management software shows a replacement drive left the shelf at 10:14 a.m. The CMMS should explain why it was issued and which asset received it. A change ticket should show who approved it. Put together, those three records describe the event without asking anyone to trust a technician’s memory.
That’s worth more attention than it usually gets. In a SOC 2 examination, maintenance data can support an availability control. Under ISO 55001, it shows how an asset decision turned into actual work. In an OT environment, it establishes the approved window for touching equipment that runs production.
A Closed Work Order Isn’t Evidence Yet
Most CMMS records were built to dispatch labor, not to answer questions six months later. A technician opens the task on a phone, ticks the completion box, types “PM completed.” Operations sees a finished job. An auditor sees a sentence.
Consider a quarterly inspection on a data center generator. The closed status tells you nothing on its own. What matters is whether the record
- names the specific generator, not the room it sits in
- shows which procedure version the technician followed
- captures test readings with enough context to judge them against acceptance criteria
- links to the corrective action when a reading falls out of tolerance
Timestamps help, but they aren’t automatically trustworthy. If your system lets someone backdate a completion or overwrite a note without keeping the earlier version, the record gets weaker rather than stronger. Same problem when supervisors share a login, or when a contractor’s work gets keyed in days later by an employee who wasn’t there. Provenance is the fix, and it means keeping the original task linked to the final result with every later correction still visible. Without it you’ve got a filing cabinet with editable labels.
SOC 2 Only Cares If the Log Supports a Control
SOC 2 isn’t a maintenance certification. You get no credit for owning a CMMS or closing 95 percent of scheduled work. The record matters when it supports a control inside the examined system and the Trust Services Criteria you selected. Say an availability control requires monthly testing of backup power. Your CMMS can show the test happened inside the examination period and whether the equipment passed, and when a failed test spawns a corrective work order you’ve shown the organization acted on the exception instead of just logging it.
Maintenance also bleeds into change control. Swapping a failed firewall appliance is physical work, but it changes the service environment. Three records carry that story.
- The CMMS establishes the failure and what the technician actually did
- The change ticket establishes who authorized the swap
- Configuration records show how the replacement device was prepared
No single one proves the control alone. That gap widens in a Type 2 examination, where the auditor tests how the control operated across a period, so a work order created during audit week won’t repair nine months of thin records. Control wording matters just as much. “Facilities performs maintenance as needed” is untestable because “as needed” has no threshold, while a control tied to an approved schedule can be tested. Whatever management says the control is, the CMMS should look like that.
ISO 55001 Wants the Decision, Not Just the Task
ISO 55001 takes a wider view. Maintenance sits inside the asset management system, and a tall stack of closed work orders doesn’t satisfy it. The records should show how you balance asset performance against cost and risk.
The 2024 edition sharpens this. Published in July 2024, it adds a clause on asset management decision-making, and organizations still running the 2014 version have until roughly 2027 to transition. A recurring seal failure stops being a sequence of repair jobs and becomes evidence about the asset’s condition. If you keep fixing the pump without ever reviewing the pattern, the records show activity and no management.
Good history runs both directions. The asset strategy explains why a task exists, and the completed work feeds back to refine it. An inspection finds corrosion moving faster than expected, so the interval changes and replacement planning starts earlier. What makes that an audit trail rather than a coincidence is the CMMS retaining why the schedule changed. Watch the metrics too, because a team can report 98 percent PM completion while deferring the two tasks attached to its highest-risk assets, quarter after quarter.
OT Maintenance Is a Security Event Too
Work on operational technology crosses into cybersecurity constantly.
- A technician plugs an engineering laptop into a controller during a routine visit
- A vendor opens a remote session to diagnose a drive
- A replacement component ships with different firmware than the one it replaced
The CMMS shouldn’t try to be a security monitoring platform. Its job is operational context, showing that the intervention was expected and approved. Security logs show how access happened, and configuration records show what changed inside the system.
Suppose a PLC fails mid-production. The CMMS records the failure and the replacement job. The security record identifies the account used during configuration, and a protected repository holds the approved logic backup. When the controller goes back into service, the work order links to the verification record instead of saying “tested OK.” Keeping those systems separate makes the evidence stronger and keeps sensitive detail out of a platform every maintenance tech can read, so point the work order at a controlled attachment rather than pasting credentials into a free-text field.
There’s no single OT compliance program that applies everywhere. NIST SP 800-82r3 covers OT security while accounting for reliability and safety constraints, and the ISA/IEC 62443 series sets requirements across the control system life cycle. CMMS records travel well across both because they connect physical intervention to authorization, but they don’t replace the security evidence generated elsewhere.
Asset Identity Is Where Trails Break
A work order can be detailed and still point at the wrong thing. It happens when equipment gets renamed after a line expansion or when an old asset ID gets recycled. It also happens when the CMMS treats a production cell as one asset while the security inventory tracks every networked component separately. You need a stable reference, because human-readable names change and the underlying identifier shouldn’t.
When one physical assembly holds several maintainable components, the parent and child relationship has to stay clear. Otherwise a technician records firmware work against “packaging line 3” while the auditor is testing controls for one specific controller. Accuracy starts before the maintenance event, and keeping an asset inventory current as equipment moves is its own discipline. Reconciliation is where it usually fails, with maintenance updating the CMMS while the OT inventory stays put and security keeps scanning a device that left the plant in March.
Parts data can strengthen the same chain or break it. A serialized replacement should be traceable from the storeroom transaction to the work order, and the receiving asset’s configuration record should reflect it afterward. That only works when your parts inventory system and the CMMS use the same part numbers and serials. Get it right and you can answer the question that actually matters when a manufacturer issues a vulnerability advisory for one hardware revision. Where is it installed?
Build the Evidence During the Job
Weak programs manufacture evidence after the fact. Someone exports a spreadsheet and adds explanatory columns. Approvals get reconstructed from email threads by people who weren’t copied on them. The package looks tidy and defends badly, and that reconstruction work is one of the hidden costs of running infrastructure processes by hand.
A better record gets created while the work happens.
- The technician identifies the asset at the point of work, by scan or ID rather than from memory
- The procedure version is already attached to the task
- Required readings can’t be skipped without an explanation
- Approvals run through named individual accounts, not a shared supervisor login
Approval routing and audit trails are standard in workflow tooling now, so most of this is a configuration decision rather than a budget one. The system also has to handle what happens after closure, because a supervisor correcting an asset number shouldn’t erase the first entry. Show the correction and its author. Quiet editing is convenient for administrators and terrible for credibility. Retention deserves the same thought, since history has to stay available for as long as the control requires and archived records need to keep their attachments.
The test is simple. Can an auditor request a sample without triggering a small data recovery project? The export should lead back to the live record, and the change ticket should carry the same asset identifier. If your evidence depends on five screenshots pasted into a Word doc, the workflow underneath is doing too little. The best audit artifact was never assembled for the audit, and it’s the ordinary maintenance record, created once and controlled properly, that still makes sense to someone who wasn’t in the building.
Maintenance Records as an Audit Artifact: CMMS Logs for SOC 2, ISO 55001, and OT Compliance
