Control A.7.8Equipment siting and protection
Equipment must be sited securely and protected.
Siting is a design decision with security consequences: where a screen faces, where a printer sits, whether a network port is reachable from a public area, whether equipment is visible from outside the building, and whether it is placed where a leak or a fire would reach it.
The control covers protection as well as position — from environmental conditions, from accidental damage, from interference and from opportunistic theft.
It applies most obviously to servers and network equipment, and most usefully to the equipment nobody thinks of as sensitive: a multifunction printer holding spooled documents, a screen in a shared area displaying a dashboard, a badge reader mounted where it can be tampered with.
In shared and co-working premises this control does most of the work that a perimeter would otherwise do, because the perimeter belongs to someone else and the equipment is the only thing the organisation controls.
How to put this in place
Where equipment sits decides who can see it, reach it or damage it. The project must place network gear, servers and sensitive screens deliberately, not wherever there was space.
- List the equipment you keep on your own premises and where it sits.
- Decide suitable locations: locked cabinets for network gear, screens not overlooked, sensitive printers in controlled areas.
- Move or protect equipment that fails these tests.
- Record locations in the asset inventory.
- Check again when you change office layout.
Evidence an auditor usually looks for: a site walk-through, equipment locations recorded in the inventory, and locked cabinets for network equipment.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.