ISO 27001:2022 · Physical controls
ISO 27001:2022 7.8: Equipment siting and protection
ISO 27001:2022 7.8 covers Equipment siting and protection. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.8, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Screens handling sensitive data face windows or public walkways.
Equipment is to be positioned securely and protected. Purpose (stated in ISO/IEC 27002:2022): lessens exposure of equipment to physical and environmental hazards and to tampering or harm. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.8.
What evidence supports 7.8?
- Annex A physical controlStatement of Applicability entry for control A.7.8, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlFloor plans showing equipment placement that limits access and overlooking of sensitive screens
- Annex A physical controlEnvironmental monitoring records for temperature and humidity with alert thresholds and responses
- Annex A physical controlLightning protection and surge filter installation records for buildings and incoming lines
- Annex A physical controlRules on food, drink and smoking near processing facilities
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.8, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Screens handling sensitive data face windows or public walkways
- No environmental monitoring exists in small server rooms or cupboards
- Organization equipment shares an unsegregated rack or room with third-party equipment
- Protection against water leaks from overhead pipes is not considered
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.