ISO 27001 A.7.8: Site and protect equipment appropriately

What A.7.8 requires in practice

Annex A control 7.8 asks that equipment is sited securely and protected. In plain terms, where a device is placed and what surrounds it should reduce the chance of damage, interference and unwanted access or viewing. The parts are to understand what the equipment does and what information it handles, to consider who can reach or see it, to check environmental conditions such as heat, dust and impact risk, and to select protection that suits the combination. A printer, a network cabinet, a shared terminal and an industrial workstation will all need different decisions. The control also recognises that a measure can create a new problem: a locked enclosure may block cooling or maintenance. The outputs are placement decisions that can be explained, protective measures that suit them, and checks that confirm they remain suitable. The standard does not specify enclosures or settings for all devices.

Assess location as part of the equipment decision

Identify the information processed or displayed, the service supported and the conditions the equipment needs. Consider who must approach it for legitimate use or maintenance, and who could reach it incidentally. Printers, shared terminals, network equipment and industrial workstations have different patterns of use and exposure.

Check what the location changes. A screen facing a public walkway may disclose information without anyone touching the device. Equipment beside a busy loading route may be exposed to impact or dust. A locked enclosure can reduce access while creating a cooling or maintenance problem if it is unsuitable. Evaluate the combined arrangement rather than treating each measure in isolation.

Use competent advice for the operating environment

Manufacturer information and appropriate technical expertise help establish suitable conditions. Environmental monitoring, protective housings or changes to the surrounding activity may be useful depending on the equipment. This is not a universal instruction to purchase specialised protection for every desk device; the decision should address an identified exposure and remain practical to maintain.

For equipment shared with, or located beside, another organisation's assets, clarify ownership and access. Similar-looking devices can lead to mistaken interference during cleaning, maintenance or relocation. Identify who may move, disconnect or service each item and how those decisions are communicated. A label can support that arrangement but does not replace a clear responsibility.

Why siting and protecting equipment matters to the business

A device in the wrong place can quietly fail or leak. Screens facing public walkways reveal information, equipment near a loading route is knocked or clogged with dust, and network devices in open corners invite tampering. Careful siting costs little when done at installation and a great deal when corrected after an incident. Customers depending on stable services expect equipment housed where it will run reliably. It also supports availability, because equipment protected from avoidable damage lasts longer and fails less often. At audit, equipment placement is easy to see on a walkthrough, so reasoned decisions about location stand out from convenience-driven ones.

How to implement A.7.8

Treat placement as a decision made for a reason, not a default. Include both new installations and equipment that has quietly moved since it was first installed. Ask the people who use the device every day whether its current location causes problems.

1. List the equipment that supports important services or handles sensitive information, including shared devices and network equipment.
2. For each item, note who needs to reach it legitimately and who could reach or view it by chance.
3. Check the surrounding conditions, using manufacturer information and technical advice on heat, dust, vibration and impact.
4. Choose placement and protection together, so that an enclosure or screening does not create a cooling or maintenance problem.
5. Agree responsibilities between IT, facilities and local operations for installing and reviewing equipment locations.
6. Include equipment moves in change control so that a new location is considered before it is used.
7. Review the arrangements after layout changes and keep a short record of the reasoning.

Illustrative manufacturing example: a workstation beside a dusty process

Illustrative IT example: a network device under a shared counter

A fictional IT support office installs a network device under a reception counter because power and connectivity are available there. Delivery personnel and contractors use the same counter, and cleaning staff sometimes move the equipment to reach the floor. A technically correct configuration does not prevent physical interference.

The company identifies a more appropriate controlled location, checks its utility and ventilation needs and assigns responsibility for access and maintenance. An authorised walkthrough confirms that ordinary reception activity no longer requires access to the equipment. The team also tests the supported service after relocation. The evidence links the new position with reduced exposure and continuing operation rather than recording only that the move occurred.

Review siting when the surroundings change

Equipment may remain stationary while its environment changes. New furniture, additional users, nearby building work or a changed public route can undermine an earlier decision. Include siting considerations in relevant changes and communicate the equipment's dependencies to people planning work nearby.

Some practical protections are simple: separating refreshments from sensitive equipment, changing a display's orientation or keeping access clear for authorised maintenance. Others need specialist design. Avoid declaring every low-cost measure adequate merely because it is easy, and avoid purchasing complex protection without understanding the risk it addresses.

Evidence should show suitability in use

Common nonconformities with A.7.8

Findings often come from locations chosen for convenience. Most reflect a location that was chosen for convenience at installation and never considered again, and can be seen on a walkthrough, so a periodic look round is worthwhile.

• Screens positioned so that passers-by can read them.
• Network or server equipment kept in open spaces or unsecured storage areas.
• Devices placed near water, dust or heavy traffic with no assessment.
• Enclosures that restrict access but cause overheating.
• Equipment moved between rooms with no consideration of the new location.