ISO 27001 Annex A 7.8 Equipment Siting and Protection is an ISO 27001 control that looks to protect equipment by siting it securely and protecting it.
In this guide you will learn how to implement ISO 27001 Annex A 7.8 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
Purpose & Definition
The purpose of ISO 27001 Annex A 7.8 equipment siting and protection is to reduce the risks from physical and environmental threats, and from unauthorised access and damage.
The ISO 27001 standard defines equipment siting and protection as:
Equipment should be sited securely and protected.
ISO 27001:2022 Annex A 7.8 Equipment Siting and Protection
White Label
ISO 27001 for Consultants
Custom-brandable ISO 27001 documentation for consultants. Easily rebrand, reduce project time, and deliver professional, high-value security systems. Focus on delivery, not drafting.
ISO 27001 Annex A 7.8 Training Video
In this free training video you will learn How to implement ISO 27001 Equipment Siting and Protection (Annex A 7.8) and Pass Your Audit.
Implementation Guide
General Guidance
What we are talking about here is equipment. The physical things that we have. This control is about being sensible and protecting them and taking appropriate precautions. Where we put stuff is important because it protects it from damage and the wrong people accessing it. We are considering examples here that may be common sense to many but not always. Here are some common examples.
Servers
If you have a server you want to make sure that it is in a dedicated server room with appropriate environmental controls and physical security controls in place. It is not great to have a server you rely on placed next to a desk and used to rest your coffee cup on. Or to have a server under an air conditioning unit that slowly drips water on it. Or in your mates garage.
Networks
Where we have network points, yes some people still do, then ideally we don’t want them in public areas and where they are in public areas they either connect to separate public networks or they are really really hard just to plug any old device into.
Environmental Factors
Environmental factors to consider will be dependant on where you work, and here we can think about working in a more industrial environment where as an example if it were dusty then we would implement dust protection, keyboard membranes and the like to safeguard our equipment.
ISO 27001 Physical Security Policy
To communicate to people what you do and what is expected you are going to write, sign off, implement and communicate your topic specific Physical and Environmental Security Policy.
How to implement ISO 27001 Annex A 7.8
Implementing ISO 27001 Annex A 7.8 requires a strategic approach to the physical placement and shielding of hardware assets.
1. Conduct an Environmental Risk and Siting Assessment
Perform a site survey to identify the optimal location for critical equipment, ensuring the environment is stable and protected from external threats.
- Identify high-risk zones prone to fire, flooding, or extreme temperature fluctuations.
- Evaluate the proximity of equipment to water pipes, HVAC units, and heavy machinery that could cause electromagnetic interference (EMI).
- Document the siting rationale in a formal Risk Assessment to serve as audit evidence.
- Verify that the chosen location supports redundant power and telecommunications feeds.
2. Provision Physical Protection and Secure Enclosures
Apply physical barriers to hardware to prevent unauthorised tampering and protect against accidental damage or environmental fallout.
- Install server racks with integrated locking mechanisms and tamper-evident seals.
- Deploy industrial-grade conduits for cabling to prevent physical tapping or accidental disconnection.
- Utilise fireproof and waterproof enclosures for critical backup media or small-form-factor devices.
- Bolting down public-facing kiosks or terminals to prevent unauthorised removal or relocation.
3. Implement Visual Privacy and Anti-Shoulder Surfing Controls
Configure the physical orientation of equipment to ensure that sensitive information displayed on screens remains confidential from unauthorised observers.
- Angle monitors away from windows, public corridors, and high-traffic office areas.
- Provision privacy screen filters for all mobile devices and workstations positioned in open-plan environments.
- Enforce strict “Clear Screen” policies to complement physical positioning.
- Utilise non-reflective glass or partitions in secure areas to prevent visual interception from outside the room.
4. Configure Environmental Monitoring and Suppression Systems
Establish automated systems to detect and suppress environmental threats before they impact the integrity or availability of the equipment.
- Install smoke, heat, and moisture sensors linked to a central monitoring dashboard.
- Provision gas-based fire suppression systems (e.g., FM-200 or Novec 1230) in server rooms to prevent water damage to electronics.
- Maintain redundant HVAC (Heating, Ventilation, and Air Conditioning) units to ensure consistent climate control.
- Deploy leak detection cables beneath raised floors in data processing facilities.
5. Restrict Physical Access via Secure Area Perimeters
Integrate equipment siting within a tiered physical security framework to ensure only authorised personnel can interact with the hardware.
- Locate critical processing facilities within a defined “Secure Area” protected by biometric or card-access control systems.
- Restrict logical access ports (USB, Ethernet) on physically accessible hardware via physical locks or disabling software.
- Formalise a Register of Entrants (ROE) to track all physical access to sensitive equipment rooms.
- Revoke physical access rights immediately upon a change in staff role or termination of employment.
How to comply
To comply with ISO 27001 Annex A 7.8 you are going to
- Use common sense in your approach to where you put stuff
- Be practical
- Ensure you follow and meet all laws and regulations such as health and safety laws
- Test the controls that you have to make sure they are working
Top 3 mistakes and how to avoid them
The top 3 mistakes people make for ISO 27001 Annex A 7.8 are
1. Equipment is NOT where it should not be
This is the biggest mistake people make. Putting things in places that they should not be. Work computers with full access in public areas and lobbies, servers under desks or at people’s homes, old equipment just lying around on desks.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Have you checked and walked the floor and visually seen that equipment is where you expect it to be? Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 7.8 FAQ
Determining the optimal location for equipment involves a risk-based assessment of physical access, environmental stability, and operational requirements.
Environmental Safety: Avoid areas prone to flooding, fire, or extreme temperatures.
Access Control: Place critical servers and storage in restricted-access rooms.
Visual Privacy: Ensure monitors and input devices are angled away from public windows or high-traffic corridors.
Proximity to Utilities: Ensure easy access to redundant power and telecommunications.
Yes, screen privacy filters are considered a primary technical control under Annex A 7.8 to prevent visual eavesdropping (shoulder surfing) in public or shared environments.
Required for laptops used in public spaces like cafes or trains.
Necessary for workstations positioned in open-plan offices facing corridors.
Supports the ‘Confidentiality’ requirement of the ISO 27001 CIA triad.
Reduces the risk of unauthorised data disclosure to visitors or unvetted personnel.
Environmental protection under Annex A 7.8 mandates that hardware is shielded from external factors that could cause damage or service interruption.
Fire & Smoke: Use of smoke detectors and non-water-based fire suppression (e.g., gas).
Water Damage: Avoidance of water pipes above server racks and use of leak detection sensors.
Climate Control: Redundant HVAC systems to prevent overheating.
EMI Shielding: Protection against electromagnetic interference from power lines or industrial machinery.
Unauthorised access is mitigated through a “defence-in-depth” approach involving physical barriers, monitoring, and strict authorisation logs.
Server racks should be locked and equipped with tamper-evident seals.
Critical hardware should be located within a “secure area” with biometric or card-access entry.
CCTV and motion sensors should monitor equipment entry points.
Unused ports (USB/Ethernet) should be physically blocked or logically disabled.
Yes, equipment can be sited in public areas provided that robust mitigating controls are in place to prevent tampering and visual interception.
Kiosks and reception terminals should be bolted to the floor or wall.
External ports must be physically locked or hidden behind secure panels.
The operating system should be locked down to “Kiosk Mode” to prevent unauthorised configuration changes.
Physical security patrols or CCTV must cover the equipment location.
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Physical Security | Protection |
| Integrity | Asset management | |||
| Availability |
Stuart Barker
ISO 27001 Ninja
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.
- MSc Security
- ISO 27001 Lead Auditor
- 30+ Years Exp
- Ex-GE Leader