ISO 27001:2022 Annex A 7.8 – Equipment Siting and Protection

• See ISO 27002:2022 Control 7.8 for more information.
• See ISO 27001:2013 Annex A 11.2.1 for more information.

ISO 27001 Annex A 7.8: Best Practices for Equipment Siting and Protection

While cyber threats, including malware attacks, SQL injection, and traffic interception, increasingly threaten the security of information assets. The risk landscape extends beyond software-based cyber attacks:

• The availability, confidentiality, and integrity of information assets may also be compromised by physical and environmental threats to IT equipment, such as servers, computers, hard drives, and removable storage media.

For instance, spilling a drink onto a server, shutting down a computer system due to high temperatures, and unauthorised access to equipment housing information assets are all examples of physical threats.

ISO 27001:2022 Annex A 7.8 describes how organisations can eliminate and mitigate risks arising from physical threats and environmental hazards.

What Is The Purpose of ISO 27001:2022 Annex A 7.8?

Annex A 7.8 provides organisations with the ability to eliminate and/or mitigate two types of risks associated with equipment containing information assets:

• Lighting, power outages, theft, interference with communications, and electrical interference are all physical and environmental threats to equipment. Also included in these threats are changes in environmental conditions, such as humidity and temperature, which can cause disruptions in information processing activities.
• Equipment that is not stored in a secure area can be accessed, used, damaged, or destroyed without authorisation.

Who Has Ownership of Annex A 7.8?

Compliance with ISO 27001:2022 Annex A 7.8 requires the creation of an inventory of equipment hosting information assets, the placement of all equipment in secure areas, and the implementation of appropriate measures to prevent physical and environmental hazards.

Consequently, Information Security Managers should establish, implement, and maintain security measures and guidelines for secure siting and equipment protection.

General Guidance on ISO 27001:2022 Annex A 7.8

ISO 27001:2022 Annex A 7.8 sets out nine requirements that must be taken into account for compliance:

1. Secure areas should be designated for sited equipment so unauthorised persons cannot access it.
2. Tools used for processing sensitive information, including computers, monitors, and printers, should be configured and positioned so that unauthorised individuals cannot view the information on screens without authorisation.
3. It is necessary to implement adequate measures to eliminate and/or mitigate risks resulting from physical and environmental threats, including explosives, communications interference, fires, dust, and electromagnetic radiation. Lightning rods, for instance, can provide adequate protection against lightning.
4. Food and drink guidelines should be developed and communicated to all relevant parties.
5. Information processing operations should be continuously monitored for environmental conditions that may disrupt them. Temperature and humidity are two of these factors, for example.
6. Buildings and offices should be equipped with lightning protection mechanisms. Lightning protection filters should also be installed on all incoming power lines, including communication lines.
7. Special protection controls, such as keyboard membranes, should be used if the equipment is located in an industrial environment.
8. It is possible for sensitive information to leak due to electromagnetic emanation. To prevent such risks, equipment housing sensitive or critical information assets must be secured.
9. An organisation should clearly segregate its IT equipment from equipment not owned or controlled by the organisation.

What Are the Changes From ISO 27001:2013?

ISO 27001:2022 Annex A 7.8 replaces ISO 27001:2013 Annex A 11.2.1 (‘Equipment Siting & Protection‘).

Despite the significant similarities between the 2022 and 2013 versions, there is one key difference to note:

• There should be clear segregation between IT equipment owned and controlled by an organisation and those not owned and controlled by it.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

We provide an intuitive and easy-to-use platform. Everyone in your organisation can benefit from it, not just highly technical people.

Building a genuinely sustainable ISMS requires involving all levels of your organisation in the process.

Achieve ISO 27001:2022 compliance with ISMS.online.

Find out more by booking a short demo.