The basics
ISO 27001 control A.7.8 Equipment siting and protection requires companies to physically protect their equipment and to place it at an appropriate site. This is important to prevent physical damage and unauthorized access to equipment.
Documentation
ISO 27001 control A.7.8 Equipment siting and protection can be documented:
- For smaller and mid-size companies by defining in the Statement of Applicability (SoA) how equipment maintenance is sited and protected (i.e., no separate document is needed).
- For larger companies by writing a Procedure for Equipment Siting and Protection.
The procedure is not mandatory but is recommended.
Implementation
In order to comply with control A.7.8 Equipment siting and protection you might implement the following:
- Technology — the technology to enable equipment siting and protection may include sensors (e.g., temperature and humidity sensors) to ensure environmental conditions comply with manufacturers’ specifications, and electromagnetic shielding, to prevent information leakage. Companies of all sizes need to plan their equipment siting and protection based on risk assessment and the required protections of equipment as defined by manufacturers.
- Organization/processes — you should set up a process for defining how equipment should be sited and configured, what is and what is not allowed to do near them, and specific protections to be applied according to the sensitivity of the information stored/processed. You can document those processes through a Procedure for Equipment Siting and Protection.
- People — make employees aware of why properly sitting and protecting equipment is needed, and train them on how to protect equipment, and identify and report equipment improperly sited or protected.
Audit evidence
During the certification audit, the auditor might look for the following evidence regarding control A.7.8 Equipment siting and protection: if equipment is being properly placed and protected.
