ISO 27001 A.7.8 - Equipment Siting and Protection

Requirement

“Equipment shall be sited securely and protected.”

Plain-language meaning

The organization should place and protect equipment in a way that reduces physical damage, environmental damage, unauthorized access, unauthorized use, and information exposure.

This includes servers, network equipment, connection panels, workstations, terminals, communications equipment, remote equipment, industrial equipment, and any other equipment used to process, store, transmit, or display information.

Why this matters

Equipment can fail or leak information because of ordinary physical conditions: heat, water, dust, vibration, unstable racks, spilled drinks, unlocked cupboards, exposed screens, poor cable rooms, or equipment placed near a window.

The control is practical: equipment should be in the right location, protected from realistic hazards, protected from unauthorized access, and included in inventories, risk assessments, and security scope.

Implementation guidance

1. Identify equipment requiring protection

Examples include:

• servers and storage devices;
• network switches, routers, firewalls, wireless access points, and patch panels;
• communications devices;
• workstations, laptops, shared terminals, and kiosks;
• printers, scanners, and fax machines;
• industrial or operational technology equipment;
• remote or branch equipment;
• equipment displaying confidential information.

2. Site equipment away from avoidable hazards

Avoid placing equipment where damage, theft, viewing, or interference is likely.

3. Protect equipment from unauthorized access and use

Controls may include:

• locked rooms or equipment cupboards;
• rack locks and cable management;
• controlled access to communications rooms and patch panels;
• secure mounting or desk locks where appropriate;
• visitor and contractor supervision;
• rules against eating, drinking, or smoking near sensitive equipment;
• clear ownership for shared and remote equipment.

4. Manage environmental and interference risks

Assess realistic environmental risks such as:

• moisture;
• vibration;
• heat;
• dust;
• chemicals;
• electrical interference;
• electromagnetic interference;
• local issues such as magnets or equipment placed too close to interference sources.

Special testing or shielding is only justified where risk is plausible and material. Do not over-engineer niche controls without a risk basis.

5. Protect displayed information

Equipment that displays confidential information should be positioned and configured to reduce unauthorized viewing.

Examples:

• position screens away from public paths and windows;
• use privacy filters where needed;
• apply A.7.7 Clear Desk and Clear Screen rules;
• lock unattended equipment;
• restrict viewing angles in reception, shared offices, and secure processing areas.

6. Include remote and networked equipment

Remote equipment can need more security attention because it may sit outside the organization’s direct physical control.

Implementation should define:

• what remote equipment exists;
• who owns and maintains it;
• which network boundaries are the organization’s responsibility;
• how the equipment is inventoried;
• how it is risk-assessed;
• how it is physically protected;
• how incidents or faults are reported.

Audit guidance

Auditors should verify:

• equipment is included in inventory and risk assessment;
• equipment siting considers damage, interference, unauthorized access, and unauthorized viewing;
• network and communications equipment is protected from inappropriate access;
• environmental hazards such as heat, moisture, dust, chemicals, vibration, water, fire, and interference are considered;
• equipment near windows, public areas, adjacent hazards, or unstable storage is assessed;
• remote and networked equipment is included in scope and responsibility boundaries;
• staff are trained in proper equipment use and protection;
• rules exist for eating, drinking, smoking, and general housekeeping near equipment.

Site walkthroughs are important. Look for screens visible from outside protected areas, equipment near windows, open network cupboards, unstable racks, drinks near devices, cable rooms used as storage, or water/fire hazards in adjacent areas.

Evidence examples

Strong evidence

• Equipment inventory maps equipment to location, owner, and protection needs.
• Risk assessments include environmental, access, viewing, and interference risks.
• Network equipment and patch panels are locked or otherwise access-controlled.
• Remote equipment is inventoried and included in ISMS scope/risk assessment.
• Walkthroughs confirm equipment is not exposed to obvious hazards.
• Staff rules are communicated and enforced.

Weak evidence

• Equipment exists but location risk is not assessed.
• Network switches or patch panels are in unlocked cupboards.
• Screens showing sensitive information face public or visitor areas.
• Remote equipment is missing from inventory and scope.
• Environmental risks are assumed to be facilities-only.
• Staff routinely place drinks, food, magnets, or storage near equipment.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.3 Securing Offices Rooms and Facilities
• A.7.5 Protecting Against Physical and Environmental Threats
• A.7.7 Clear Desk and Clear Screen
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.5.15 Access Control
• A.6.7 Remote Working
• Risk Assessment
• Equipment Siting and Protection Assessment
• Equipment Protection Inspection Checklist
• Remote Equipment Register
• A.7.8 Audit Evidence Pack
• A.7.8 Audit Checklist

KB-ready summary

• Know what equipment exists and where it is.
• Site equipment away from avoidable hazards.
• Lock or restrict access to communications and network equipment.
• Protect screens and terminals from unauthorized viewing.
• Include remote equipment in inventory, scope, and risk assessment.
• Audit through walkthroughs, not just document review.

Templates and checklists

• Equipment Siting and Protection Assessment
• Equipment Protection Inspection Checklist
• Remote Equipment Register
• A.7.8 Audit Checklist