ISO 27001 Control A.7.8: Equipment Siting and Protection

Where you put a piece of equipment decides a surprising amount about how safe it is. A server under a leaking pipe, a monitor facing a ground-floor window, a printer in the corridor where every visitor passes, a network switch in a cupboard that also stores mop buckets. None of these needs a clever attacker. They need only bad placement. A.7.8 is the eighth of 14 physical controls in our walk through Annex A, and it is about getting the basics of location right.

It is also a control that is much cheaper to satisfy at the planning stage than after the fact. Moving a rack is a project; choosing the right room in the first place is a decision. If you are about to fit out a new office, change suppliers for a hosting room or add a few devices to a busy floor, this is the moment to apply it.

What the control requires

Annex A control 7.8 of ISO 27001:2022 states that equipment shall be sited securely and protected.

The key elements:

Equipment - servers, network devices, workstations, printers, displays, storage and any other hardware that handles or stores information
Sited securely - positioned so that the risks of unauthorized access, viewing, interference and environmental damage are reduced
Protected - supported by measures such as physical barriers, environmental safeguards and monitoring, as the risk requires

A.7.8 is a preventive control as classified in ISO/IEC 27002:2022. Annex A gives the one-line requirement; ISO 27002 provides the guidance, which covers positioning to minimize unnecessary access to work areas, protecting storage facilities from unauthorized access, adopting controls against physical and environmental threats, and considering eating, drinking and smoking rules near equipment. The guidance is also clear that you should consider threats such as theft, fire, explosives, smoke, water, dust, vibration, chemical effects, electrical supply interference and electromagnetic radiation. You do not need to protect against all of them equally. You need to look at your own site and decide.

How to implement equipment siting and protection

Start with a walk-through and a risk view

Walk the building with a plain question: what could go wrong with each piece of equipment where it sits today? Then rank by value. A server room, a comms cabinet and the finance director’s laptop dock deserve more thought than a spare monitor. Record the findings in your risk assessment, as clause 8.2 on information security risk assessment expects, so the siting decisions feed the same register as everything else.

Typical siting questions include:

Is the equipment in an area covered by your physical security perimeters, or in a public or shared space?
Is it near water pipes, kitchens, air conditioning drains, roof lines or basements that flood?
Is it exposed to heat, direct sun, dust or vibration?
Could a passer-by read a screen or overhear what is said near it?

Protect against access and observation

Put critical equipment in rooms that can be locked and that fit the design thinking in securing offices, rooms and facilities. For servers and network gear, use lockable racks or cabinets, even inside a locked room; the room may have many keys in circulation and the cabinet adds one more layer. Position screens and keyboards that handle sensitive data away from windows, doorways and reception areas, and use privacy filters where an ideal layout is impossible. Printers and scanners that handle confidential documents should sit where users can collect output promptly, which also supports clear desk and clear screen.

Think about eavesdropping in the broader sense too. Meeting rooms with thin walls, speaker phones near public areas and video conference equipment that stays on can all leak more than a camera does. Treat them as part of the same exercise.

Protect against environmental damage

Choose locations that do not depend on luck. Keep equipment off the floor in rooms at risk of flooding, away from water sources, and out of areas where heat builds up. Fit smoke or fire detection and suppression suitable for electronics where the risk justifies it, and ensure temperature and humidity are within the ranges recommended by the equipment makers. For a small office, a modest measure might be a thermometer with an alert and a rule that no one stacks boxes against the server cabinet vents. For a larger site, it means proper environmental monitoring with notifications. The wider theme of protecting against physical and environmental threats is covered in A.7.5, and the siting decision is where those assessments become concrete.

Do not forget the human habits near equipment. Food and drink near servers and open-plan desks cause real spills. A short rule, supported by the right furniture, is normally enough.

Keep it current

Siting is not a one-off. Offices are rearranged, teams grow, a storage cupboard becomes a comms room, and a floor plan from two years ago no longer describes reality. Tie siting checks into change management and into your regular review of the asset inventory so that new equipment is placed deliberately. Include a siting question in your procurement checklist: where will this go, and who else can reach it? When the answer changes, the protection should change with it.

A.7.1 connection. Physical security perimeters decide which areas are protected enough to house sensitive equipment.

A.7.3 connection. Securing offices, rooms and facilities covers the rooms in which equipment is placed.

A.7.4 connection. Physical security monitoring watches the places where critical equipment lives.

A.7.5 connection. Protecting against physical and environmental threats provides the threat picture that drives sensible placement.

A.7.7 connection. Clear desk and clear screen deals with what is visible on screens and desks once the equipment is in place.

Clause 8.2 connection. Information security risk assessment is where siting risks are recorded, rated and treated.

Forward reference. Security of assets off-premises (A.7.9), Supporting utilities (A.7.11) and Cabling security (A.7.12) follow in the series and extend siting thinking to laptops on the road, power supplies and the cables that connect everything.

What auditors check

Where critical equipment actually is. Auditors often ask to see the server room, comms cabinets and key network equipment, then judge whether the location suits the risk.

Environmental protection. They look for evidence of fire detection, temperature management and protection from water, in proportion to what is stored.

Access to equipment. Locked rooms and racks, controlled keys and the absence of unrelated storage in sensitive rooms are common points of attention.

Screen and printer positioning. Expect a look at reception, open-plan areas and shared printers to see what a visitor could observe.

Risk assessment link. Auditors may ask how siting decisions were reached and whether they appear in the risk assessment and treatment plan.

Change handling. They check how a new or relocated device gets reviewed for siting, rather than just plugged in.

Common mistakes to avoid

Servers in a general-purpose cupboard. A comms cabinet shared with cleaning supplies, spare furniture or archive boxes invites water, heat and unauthorized access.

Trusting the locked room alone. If many people hold keys, a lockable rack adds meaningful protection at little cost.

Screens facing windows or reception. Sensitive data on display where visitors pass is an easy observation that needs only a rearranged desk.

Ignoring heat. Overheating equipment in a poorly ventilated space fails quietly until it fails loudly. Monitor temperature, even if only with a basic sensor.

No process for new equipment. The first device is sited carefully and the next ten are plugged in wherever there is a socket. Add a siting question to purchasing and change routines.

Forgetting landlord areas. In shared buildings, risers, plant rooms and shared comms areas may sit outside your control. Know what is yours, and agree responsibilities with the landlord.

Treating the control as a one-time project. Layouts change. Review siting when you move desks, add equipment or change use of a room.

How 27kay can help

We help organizations look at their sites with fresh eyes, find the quiet placement problems that cause expensive surprises, and fix them proportionately. As part of ISO 27001 implementation, we walk through your premises, link siting decisions to your risk assessment, and prepare the evidence an auditor expects. For the full picture, see our ISO 27001 knowledge hub.

Do you know what sits behind the door marked “comms” in your office, and what is on the other side of its wall? Get in touch - we will help you answer both, and enjoy the walk-through along the way.