ISO 27001 Equipment Siting and Protection: Control A.7.8

Equipment protection begins before installation. Where an asset is placed determines who can see or touch it, which environmental conditions affect it, how easily it can be stolen and whether maintenance can occur safely. ISO/IEC 27001:2022 Annex A control 7.8 addresses equipment siting and protection as part of the physical-control set.

This is broader than server rooms. Network cabinets in corridors, reception tablets, office printers, security cameras, warehouse terminals, laboratory controllers and edge devices can all process or enable access to important information. Their safeguards should follow risk and operating context.

Use the current control structure

Older material may refer to equipment security under Annex A.11.2 in ISO/IEC 27001:2013. The 2022 edition reorganised Annex A, and equipment siting and protection appears at A.7.8. Related concerns sit across other controls, including physical perimeters, physical entry, monitoring, protection against environmental threats, working in secure areas, off-premises assets, storage media, supporting utilities, cabling security, maintenance and secure disposal or reuse.

Do not convert an old control number mechanically. Reassess the risk, map the current controls and update the Statement of Applicability and operational evidence where necessary.

Build an equipment population that supports decisions

Start with the asset inventory, then group equipment by location and exposure. Capture enough information to decide protection:

• owner and operational purpose;
• information or service supported;
• physical location and zone;
• portability and attractiveness for theft;
• environmental operating limits;
• network, power and communication dependencies;
• maintenance party and access method;
• recovery priority; and
• movement or disposal status.

Avoid false precision. A fleet of equivalent managed laptops can be governed as a population with assigned records, while a unique industrial controller may need an individual assessment. The asset inventory ownership guide provides a practical structure.

Assess threats at the intended location

Walk the site with facilities and equipment owners. Drawings are helpful but may omit real conditions such as an unlocked loading-bay route, a leaking pipe or a cabinet used for unrelated storage.

Consider:

• unauthorised physical access and tampering;
• theft or accidental removal;
• screen or indicator visibility;
• heat, cold, humidity, dust and vibration;
• water, fire, smoke and chemical exposure;
• unstable power and utility interruption;
• damaged or exposed cabling;
• impact from vehicles, stock movement or people;
• interference with wireless or sensor operation; and
• maintenance access that bypasses normal restrictions.

Assess consequence across confidentiality, integrity and availability. A device with no stored data may still be critical if its loss stops production or disables monitoring.

Select siting and protection measures

Reduce unauthorised access

Place equipment within an appropriate physical zone. Use locked rooms, cabinets, cages, mounting, tamper evidence or anchoring according to exposure. Position screens and printers to prevent unnecessary viewing. Avoid placing network ports, reset controls or removable media within public reach.

The surrounding access system matters. A locked cabinet in an unrestricted corridor may require stronger construction, key control and monitoring than the same cabinet inside a restricted room.

Control environmental exposure

Keep equipment away from water sources, direct heat, excessive dust and high-traffic impact paths where possible. Use detection, suppression, cooling, filtration, barriers or enclosures when relocation is impractical.

Protection should match manufacturer operating limits and the service’s recovery needs. A sensor that raises an alert is useful only if alerts are received, investigated and escalated in time.

Protect power and communications

Supporting utilities and cabling may be single points of failure. Consider surge protection, uninterruptible power, alternative supply, generator capacity, protected cable routes and separation from interference or accidental damage.

Test under realistic conditions. A power unit that lasts ten minutes is adequate only if shutdown or alternate supply can be achieved within that period. Preserve test results and corrective actions.

Manage maintenance safely

Maintenance can expose equipment, configurations and data. Authorise providers, supervise where necessary, record work, protect credentials and confirm secure return to service. If equipment leaves the site, assess data protection, chain of custody and supplier controls.

After maintenance, verify that covers, locks, monitoring and configurations have been restored. Repeated emergency access may indicate poor capacity planning or support design.

Address distributed and off-premises assets

Field devices and equipment at employee, customer or supplier locations may lack corporate physical controls. Specify minimum site conditions, custody, reporting, transport and recovery. Use tamper-resistant design, encryption and remote management where appropriate, while recognising that technical protection does not remove physical availability risk.

Coordinate related controls

Equipment siting should not duplicate the whole physical-security programme. Instead, link decisions:

• the inventory identifies owner and location;
• classification and risk establish impact;
• physical zoning limits access;
• monitoring detects events;
• utility controls support availability;
• maintenance governs authorised intervention;
• off-premises rules address custody; and
• disposal or reuse prevents residual information exposure.

For dedicated facilities, see the ISO 27001 data-centre security guide. For workspaces and visible devices, the clear-desk and clear-screen guide covers control 7.7.

Use the free Annex A control lookup to review adjacent controls, then document the organisation’s own applicability decisions.

Distinguish installation evidence from operating evidence

Installation records show that protection existed on day one. Auditors also need to know whether it remains effective.

Design and installation evidence

Useful evidence includes site risk assessments, floor plans, zone decisions, equipment specifications, installation approvals, environmental limits, utility capacity calculations, cabinet or mounting requirements and acceptance tests.

Operating evidence

Operating evidence may include:

• current asset-location records;
• physical access and key records;
• environmental and power alerts;
• inspection and maintenance histories;
• generator or battery tests;
• tamper events and investigations;
• approved relocation records;
• supplier service reports; and
• corrective-action closure.

Evidence should be attributable and time-bound. A photograph of a locked cabinet does not show who can open it, whether the lock works over time or how alerts are handled.

Audit using zones and asset samples

Build a sample across risk and operating environments. Include a critical device, a publicly accessible device, an off-premises asset, a recently installed or moved item, and equipment maintained by a third party. Add a random sample to avoid examining only assets selected by management.

For each item, trace the inventory record to its actual location, risk decision, installed safeguards, maintenance and recent monitoring. Inspect cable routes, power, water exposure, screen visibility, cabinet locks and surrounding activity. Confirm that the device is where records say it is.

Useful audit questions include:

• Who approved this location and on what risk basis?
• Which environmental limits matter, and how are they monitored?
• Who can physically access or remove the equipment?
• What happens when power or cooling fails?
• How is maintenance authorised and verified?
• When was the protection last tested?
• Are moved or retired assets reflected in records promptly?

The free risk score calculator can support prioritisation, but local knowledge and service impact should shape the final sample.

Interpret control performance

A pass would show risk-based placement, suitable safeguards, controlled access, monitored conditions, tested utilities and consistent maintenance evidence. A partial result might show adequate installation but stale location records or incomplete alert follow-up. A fail could involve critical equipment in an exposed area, uncontrolled cabinet keys, repeated environmental alarms without action or unknown asset locations.

Evaluate the system, not cosmetic tidiness. A visible cable is not automatically a finding; determine whether it creates interception, damage or service risk. Conversely, a neat equipment room can still fail if unauthorised people have keys or environmental alarms are ignored.

Reassess after change

Review siting when equipment is moved, office layouts change, capacity grows, supporting utilities are altered or incidents reveal a new threat. Temporary deployments deserve explicit end dates and safeguards; otherwise, temporary arrangements tend to become permanent without review.

ISO’s official ISO/IEC 27002 page describes the current control-guidance standard. Use the licensed publication for complete control wording. The management task is to translate that guidance into location-specific protection and evidence that it continues to work.