Equipment siting and protection

What the requirement asks

Equipment is to be positioned securely and protected. Purpose: lessen exposure of equipment to physical and environmental risks and to tampering or harm. Guidance: consider placing equipment so that people do not need to pass through work areas unnecessarily and unauthorized access is avoided; positioning facilities that handle sensitive data so unauthorized people cannot view information while they are in use; controls against physical and environmental risks such as theft, fire, explosives, smoke, water or loss of water supply, dust, vibration, chemicals, disturbance to power or communications, electromagnetic radiation and deliberate damage; rules on eating, drinking and smoking near processing facilities; monitoring temperature, humidity and other conditions that could harm operation; lightning protection on all buildings with filters on incoming power and communication lines; special protection such as keyboard membranes in industrial settings; protecting equipment that handles confidential information against leakage through electromagnetic emanation; and physically separating facilities the organization manages from those it does not. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Equipment siting is a physical risk decision. The guidance asks for the location, the protection, the environment and the access.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep floor plans showing equipment placement that limits access and overlooking of sensitive screens and one live sample together.

Evidence an assessor asks for

• Equipment placementFloor plans showing equipment placement that limits access and overlooking of sensitive screens
• Equipment placementEnvironmental monitoring records for temperature and humidity with alert thresholds and responses
• Equipment placementLightning protection and surge filter installation records for buildings and incoming lines
• Equipment placementRules on food, drink and smoking near processing facilities
• Equipment placementAssessments of electromagnetic emanation risk for equipment handling confidential information, where applicable
• Equipment placementEvidence of physical separation between organization-managed facilities and third-party equipment, for example in shared rooms

The question an assessor will ask

An assessor will ask for floor plans showing equipment placement that limits access and overlooking of sensitive screens, then trace it to the system it protects. For A.7.8 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Screens handling sensitive data face windows or public walkways
• No environmental monitoring exists in small server rooms or cupboards
• Organization equipment shares an unsegregated rack or room with third-party equipment
• Protection against water leaks from overhead pipes is not considered

Before the next audit

Before the next audit, check one live sample for this gap: screens handling sensitive data face windows or public walkways.