ISO 27001 Annex A 7.8 Audit Checklist

In this ultimate how to audit guide to ISO 27001 Annex A 7.8 Equipment Siting and Protection, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.8 Equipment Siting and Protection Audit Checklist

Auditing ISO 27001 Annex A 7.8 Equipment Siting and Protection is the systematic technical verification of the physical and environmental resilience of information processing assets. The Primary Implementation Requirement demands secure placement and environmental hardening, providing the Business Benefit of ensuring continuous availability and operational integrity.

This technical verification tool is designed for lead auditors to establish the environmental and physical resilience of critical information processing assets. Use this checklist to validate compliance with ISO 27001 Annex A 7.8.

1. Environmental Risk Assessment for Equipment Siting Verified

Verification Criteria: A documented assessment exists identifying potential environmental threats (e.g. fire, flood, earthquake, civil unrest) for all sites housing critical equipment.

Required Evidence: Physical Risk Assessment or Business Impact Analysis (BIA) with site-specific environmental threat mapping.

Pass/Fail Test: If the organisation has sited a data centre or server room in a high-risk flood zone or below water pipes without documented mitigation, mark as Non-Compliant.

2. Protection Against Environmental Threats Confirmed

Verification Criteria: Physical controls are in place to protect equipment from identified environmental hazards, such as fire suppression systems and raised flooring.

Required Evidence: Maintenance logs for gas-based fire suppression (e.g. FM200/Inergen) and physical sighting of leak detection sensors.

Pass/Fail Test: If critical ICT equipment is located in a room with standard water sprinklers or lacks fire detection integrated into the central alarm, mark as Non-Compliant.

3. Restricted Access Siting for Processing Assets Validated

Verification Criteria: Information processing facilities are sited in a manner that minimises public access and avoids unnecessary transit of personnel through secure areas.

Required Evidence: Site floor plans showing that the server room or archive is not located on a primary thoroughfare or near public reception.

Pass/Fail Test: If the main server rack is located in an open-plan office or a communal corridor accessible to visitors, mark as Non-Compliant.