A.7.8 Equipment siting and protection: requirements and evidence

What A.7.8 equipment siting and protection requires in practice

If an auditor asks how you decided where your equipment sits, A.7.8 asks you to site equipment so that it is protected from physical and environmental threats and from unauthorized access and damage. The control does not prescribe a particular room, rack or distance. It expects you to have considered where each piece of equipment that handles information is placed, why that location was chosen, and what protects it once it is there. The risks it targets fall into three groups: environmental conditions such as heat, humidity, dust and water; people who should not be able to reach, touch or tamper with equipment; and information leakage, where a screen, printer, or unlocked device can be read or photographed from a corridor or a neighboring desk.

What makes this control hard to evidence is that it is judged site by site. A server room in a headquarters building, a wiring closet in a branch office and a laptop docking station in a shared workspace each present different threats, so an assessor will expect a site-level view rather than one policy statement. Equipment also moves. Facilities teams relocate racks, procurement installs devices in whatever spot is free, and staff set up displays near windows or entrances without involving the security team. Your practical job is to define who may decide placement, record the siting rationale for critical locations, and check periodically that equipment still sits where the decision said it would. Food and drink rules, screen orientation and shielding against eavesdropping are often overlooked in that process, so confirm them with each site owner.

A.7.8 is closely related to A.7.5 (protection against physical and environmental threats), A.7.11 (supporting utilities) and A.7.12 (cabling security), and an assessor will often test them together because a poorly sited device can be exposed to the same hazards. Confirm the exact wording and expectations with the published text in ISO/IEC 27002:2022 from the IEC Webstore and with your own certification body, since ISO does not certify organizations and only an accredited certification body can issue a certificate. A useful first step is a site register listing critical equipment, its location, the threats assessed for that location and the date of the last review.

Which equipment, rooms and third-party sites A.7.8 covers

A.7.8 applies to any place where equipment that handles information is sited, not only the main data center. The boundary follows the ISMS scope and each site's risk assessment, so the list below is where scoping decisions usually change the amount of work.

Server rooms and comms closets

Small server rooms, wiring closets and network cabinets in branch offices are often missed because they sit outside the main data center. Check each one for location, lockable enclosures, exposure to water, heat and dust, and who can reach the equipment. An auditor will ask whether these sites appear in the asset inventory and the siting review, not only the headline facilities.

Offices with screens showing sensitive data

Equipment siting matters where a monitor, printer or terminal can be read by visitors or passers-by. Review the placement of screens in customer service areas, trading floors and back offices, and where printers collect output. Confirm that positioning and privacy measures reflect the sensitivity of what is displayed.

Edge devices and field equipment

Routers, sensors, kiosks and gateways placed at remote sites, customer premises or plant floors often have the weakest physical protection. Record where each device sits, who can access it, and what happens if it is removed or tampered with. Decide early whether these devices fall inside the ISMS scope, because they are easy to forget during scoping.

Cloud and colocation sites

Where a cloud provider or colocation operator hosts the equipment, the organization does not control the room but still owns the risk. Ask the provider for its own physical and environmental controls, such as siting, power and fire protection, and record which of them the organization inherits. Keep the provider's assurance reports in the supplier file so the inherited controls can be shown to an auditor.

Remote and home workspaces

Staff who work from home place company equipment and printed material in rooms the organization does not control. Set rules for where screens face, where equipment is stored when not in use, and how household heat, liquids and visitors are handled. Link these rules to the remote working and off-premises controls so the expectations are consistent.

Scope confirmed by risk assessment

The final list of sites is set by the ISMS scope and the risk assessment for each location, not by the size of the room. Document which sites are in scope, the reason for each exclusion, and the owner who signs off. Confirm the list with the certification body before the audit, since an undocumented exclusion is a common source of findings.

Who owns the siting decisions and who prepares the evidence

The organization decides where equipment sits and accepts the residual risk of each location. Facilities, IT operations and the information security function share this, and the ISMS must show who approved each siting decision and on what basis. Ownership cannot be handed to a consultant, because the Statement of Applicability and the risk treatment decisions are the organization's own statements.

Placement decisions: Facilities and IT agree which rooms, racks and cabinets hold which systems, based on the threats identified for each site.
Risk acceptance: A named manager signs off on any location that falls short of the site standard, such as a server closet with shared access.
Environmental limits: Operations sets the temperature, humidity and food and drink rules that apply in each area.
Change approval: Moves, new racks and new equipment go through a documented change process that the security team reviews.
Ongoing ownership: The control owner keeps the site register current and reviews it when the estate changes.

Confirm that each equipment location has a named owner and that the approval trail for siting decisions exists before any partner starts collecting evidence.

How an assessor tests equipment siting and protection

This table sets out what an assessor does for A.7.8, what evidence they ask for, and where organizations usually fall short. Read each row as a test the organization should be able to pass before the audit, with the evidence named in the middle column. The main takeaway is that an assessor compares what is documented with what is physically in place, so placement decisions need a paper trail that matches the room.

Test or check	Evidence the assessor requests	Common finding
Walk the sites and compare placement with documented siting decisions	Site plans or floor layouts, equipment inventory with locations, siting decision records	Servers or network gear in locations that no siting record describes
Review the site risk assessment for environmental and access threats	Documented risk assessment per site covering heat, water, fire, flood and unauthorized access	Assessment exists but was never updated after a site or room change
Check environmental monitoring and alarms	Monitoring configuration, alarm thresholds, sample alarm logs for temperature, humidity and water detection	Alarms fire but no acknowledgment, escalation or response records exist
Sample visitor and access logs near equipment	Access logs for the rooms or cabinets holding equipment, visitor sign-in records, access authorization list	Logs are incomplete for the equipment room, or access lists include people who no longer need it
Check food and drink rules and shielding for sensitive screens	Written food and drink rule for equipment areas, signage, observed compliance, screen placement records	Rule exists only in a policy document, and sensitive screens face windows or public corridors
Test whether placement changes went through a documented review	Change tickets or review sign-offs for moved, added or relocated equipment, with dates and approvers	Equipment placed without a review, or changes recorded only after the fact

Implementing A.7.8 step by step, with the output of each step

The sequence moves from knowing which equipment and sites are in scope to rules, controls, monitoring and change review that keep siting decisions current. Each step produces a record an assessor can sample.

Inventory equipment and sites in scope
Start by listing every site, room and rack that holds information processing equipment within the ISMS scope, then list the equipment in each location. The security or facilities lead owns the list, with IT confirming asset records. Record the site, room, equipment owner, classification of the information it processes and its dependence on utilities. The output is an equipment register linked to the asset inventory from the organizational controls. You know the step is done when a sample of servers, network gear and sensitive displays can be traced to a named location and owner.
Run a siting risk assessment per site
For each site in the register, assess the threats that could reach the equipment: environmental conditions such as heat, humidity, water and dust, unauthorized access to the room or cabinet, and information leakage from screens, printers or unshielded cabling. Involve facilities, physical security and the equipment owners, and use the risk methodology already adopted for the ISMS. The output is a dated site assessment for each location listing threats, likelihood, impact and the chosen treatment. It is done when every register entry points to an assessment that a reviewer can follow back to a documented decision.
Define siting and protection rules
Turn the assessments into a written rule set that covers placement of equipment away from exposed windows, drains and heat sources, cabling clearance from power and access routes, and shielding or privacy filters for sensitive displays. Include food and drink limits in equipment areas and who may approve exceptions. Security, facilities and IT approve the rules, and the owner of the policy publishes them. The output is an approved rule set with version and approval records. It is done when each rule can be linked to the risk it treats and the people who must follow it have acknowledged it.
Apply and record controls at each site
Apply the rules to each location: reposition equipment where the assessment requires it, install cable management, shielding or filters, post food and drink signage, and restrict access to cabinets or rooms. Facilities or the site operator carries out the physical work, and the security lead signs off each site. Keep work orders, photographs of the installed state and a note of any residual risk accepted by management. The output is a site record per location showing what was applied and when. It is done when a walk-through matches the site record for every entry in the register.
Set up environmental monitoring and alarm response
Configure sensors for temperature, humidity, water leakage and, where the assessment calls for it, power and smoke or fire detection in equipment rooms. Set thresholds from the equipment vendor's operating ranges and the site assessment, and route alarms to a named on-call role. Write the response steps for each alarm type and test them on a schedule the organization sets. The output is a monitoring configuration export, the alarm routing list and a log of test alarms and responses. It is done when a test alarm reaches the responder and the response is recorded.
Establish a review step for new or moved equipment
Add a check to the change process so that any new, relocated or re-cabled equipment is assessed against the site rules before it goes live. The requester submits the change, the security or facilities lead confirms placement, cabling and shielding, and the site record is updated. Schedule periodic reviews of the register and site assessments so changes made outside the process are found. The output is change records tied to the register and updated site assessments. It is done when a sample of recent changes shows a completed review before go-live and the register matches the floor.

How environmental conditions and information leakage fit into siting

Siting under A.7.8 covers more than keeping equipment behind a locked door. The parts most often missed are the environmental conditions in the room, protection from water and dust, food and drink near equipment, and placement that limits what a person or device outside the room can see or pick up. An auditor will expect the organization to have looked at each of these for every room that holds information processing equipment, and to have recorded what it decided. Start with a site walk that asks where temperature and humidity are controlled, where water could reach equipment (overhead pipes, roof lines, floor drains, cleaning routes), where dust is generated, and where people eat or drink. Record the answers against each room so the evidence can be matched to the risk.

Information leakage is the subtler part. Screens facing windows or public corridors, printers in shared walkways, and equipment placed close to exterior walls or to other organizations' premises can expose data without any intrusion. Electromagnetic emanations and visual observation are the two leakage paths most often discussed, and the right response depends on the data and the threat. A bank's transaction terminals and a clinic's reception desk do not need the same shielding, and neither should simply copy a default. The organization must decide and document the level of shielding for each area based on the classification of the data and a stated threat assessment, and it must be able to explain why a lower level is acceptable. Ask the facilities and security teams to confirm which rooms have shielding, what it was designed to block, and when it was last inspected.

Food and drink rules are simple to state and easy to neglect. Decide which areas prohibit food and drink, put that rule in the working procedures, and check that signage and cleaning contractors follow it. Environmental monitoring, such as temperature and humidity sensors with alerts, gives an auditor evidence that the conditions were checked and acted on. Confirm with the facilities owner what thresholds apply, who receives alerts, and how excursions are logged. Because these checks overlap with A.7.5 Protecting against physical and environmental threats and A.7.11 Supporting utilities, avoid duplicating records: note the siting decision in one place and cross-reference it from the others.

Evidence that passes A.7.8 and how to keep it current

An assessor testing A.7.8 wants to see that equipment placement was decided deliberately, recorded, and still matches reality on the day of the audit. The artifacts below connect a siting decision to the location of each device, the rules that govern it, and the monitoring that shows the environment stays within limits. Each one needs a named owner and a trigger that refreshes it between audits.

Site siting risk assessment

This is the documented reasoning behind where equipment sits. It should consider flood and water exposure, fire, heat, unauthorized access routes, proximity to windows and public areas, and the threats identified for each site under A.7.5. Assessors look for a link between each identified threat and the siting choice made to address it. Keep it current by reviewing it after any site change, new facility, or incident, and at a fixed interval the organization sets in its own procedure. Confirm with the auditor which review interval they expect to see evidenced.

Equipment register with locations

The register lists each server, network device, and storage unit with its physical location down to room, rack, or cabinet. A useful register ties each entry to an asset ID used in the CMDB or inventory tool, so an auditor can pick a device and trace it to a location. Gaps between the register and the floor are the most common finding in walkthroughs. Reconcile the register against a physical count on a schedule and whenever equipment is installed, moved, or removed.

Siting and protection rules

These are the written rules that tell staff and contractors how equipment is placed and protected: no food or drink in server rooms, minimum clearances from water pipes, restrictions on placing equipment near exterior walls, and shielding expectations where information leakage is a concern. Rules should name who approves exceptions. Review them when the facility layout changes, and confirm that staff acknowledged the current version, since an auditor will ask how the rules reached the people who work in those areas.

Environmental monitoring and alarm response logs

Temperature, humidity, water detection, and power readings for equipment areas show whether the siting decisions hold in practice. Keep the threshold values, the alert history, and a record of who responded and what they did. A log with alerts but no response entries suggests the monitoring is not acted on. Export samples at regular intervals and test alert routing at least as often as the organization's own schedule requires, then store the test results as evidence.

Change records for moved equipment

Every move, install, or decommission of equipment should produce a change record that names the old and new location, the approver, the date, and the checks done after the move, such as confirming power, cooling, and access controls at the new position. Auditors often sample these records against the register to see whether the register was updated. Tie change tickets to the register entry, so a single trigger updates both and the link is provable.

Walkthrough notes and dated photos

Periodic walkthroughs by the security or facilities owner produce notes and photographs that show equipment placement, clearances, food and drink controls, and visible shielding or enclosures. Record the date, the person, the areas covered, and any findings with a follow-up owner. Between audits, schedule walkthroughs and add an unscheduled one after any relocation, facility work, or reported incident. Photos should not expose sensitive layout details outside the audit file, so store them with restricted access.

What meeting A.7.8 costs in money and effort

This table breaks down the main cost and effort components of meeting A.7.8 Equipment siting and protection, showing who is paid, whether each cost is one-time or recurring, and what drives it up. Use it to build a request for quote, since no fixed price applies to every site and most of the cost depends on the equipment room and the risk assessment.

Cost component	One-time or recurring	What drives it and how to keep it down
Site risk assessment time	One-time, repeated when sites or threats change	Number of rooms and sites, and how many threat types are assessed. Keep it down by covering shared threats once and recording only site-specific differences.
Physical changes to rooms (racks, cooling, shielding)	One-time capital work, with some recurring upkeep	Room condition, existing cooling capacity and need for shielding against leakage. Keep it down by siting new equipment in rooms that already meet the requirement and fixing only the gaps the assessment finds.
Environmental monitoring tools and sensors	Hardware one-time, licensing and hosting recurring	Number of sensors, alert integration and retention period. Keep it down by choosing self-hosted open-source monitoring with documented alert records, and confirming the features in the vendor documentation first.
Staff time for walkthroughs and change review	Recurring	Frequency of walkthroughs, number of rooms and how often equipment moves. Keep it down by folding checks into existing facilities rounds and using a single change record for siting decisions.
External review or site survey	One-time, with periodic repeats	Site count, access constraints and whether an outside specialist is needed for shielding or thermal review. Ask for the survey scope in writing and the list of deliverables.
Auditor sampling	Recurring each audit cycle	Number of sites and rooms the auditor selects, and how complete the records are. Keep it down by keeping siting records, photos and environmental logs in one place so sampled items can be shown quickly.

Questions buyers ask about A.7.8 before hiring outside help

How much effort does A.7.8 take for a small office compared with a data center?

The effort scales with the number of rooms holding equipment, the number of risks each room carries and how much of the environment the organization controls. A small office usually has one or two rooms, a handful of network devices and a landlord responsible for the building, so the work is mostly a documented siting review, a check of who can reach equipment and a short list of environmental risks such as heat, water and power loss. A data center involves many rooms, raised floors, cooling plant, fire suppression and sometimes third-party colocation, so the siting record covers far more locations and more dependencies. Ask any provider to break its estimate down by site, room and the number of environmental risks it will assess, and ask which parts depend on a landlord or colocation operator whose records you will need to obtain.

Does a cloud-only company still need to address A.7.8?

Yes, but the control is usually satisfied by reviewing the cloud provider's evidence rather than by siting hardware yourself. The organization does not own the data center, so it cannot show physical siting directly, yet it still owns the decision about which providers, regions and availability zones hold its data and how its staff and devices are protected. Typical evidence includes the provider's current independent assurance reports and certifications reviewed against your scope, a record of the regions you chose and why, and the controls on any office where laptops or company devices are used. Confirm with your auditor which provider evidence they will accept and how they treat the shared responsibility split for your environment.

What does the work need from internal staff?

Internal staff must supply knowledge that no outside party has: where equipment physically sits, who has access to each room, which environmental systems support it and who is responsible for them. Facilities, IT operations and the landlord or colocation contact usually need to confirm floor plans, cooling and power arrangements, fire suppression and the access list. Staff also need to approve the siting decisions, own the resulting risk acceptances and keep the records current when equipment moves. Budget internal time for these reviews and for walking the sites with whoever supplies the evidence, because an implementation partner can document what it is shown but cannot confirm conditions it cannot see.

Can an implementation partner prepare the evidence for A.7.8?

Yes. An implementation partner can help prepare the siting records, the environmental risk assessment, the access and visitor rules for equipment rooms, and the link between those records and your Statement of Applicability. The organization keeps ownership of the control, the decisions and the residual risk, and must be able to show that staff follow the rules. The partner is preparing systems and evidence for an assessment, not issuing a report. Ask for a written scope listing which documents, site walks and interviews are included, who signs each record, and how the evidence will be kept after the engagement ends.

Can the same firm that helps us prepare also act as our auditor?

No. An independent auditor or certification body must assess the controls and issue any report or certificate, and it must remain independent of the work used to prepare them. An implementation partner that prepared your siting records cannot also assess them for certification, because that would remove the independence the assessment depends on. Choose the certification body separately, confirm its accreditation and ask it what evidence it expects for A.7.8 before the preparation work starts, so that the partner's deliverables match what the auditor will test.

How often should equipment siting be reviewed?

Review siting whenever something material changes, and also on a fixed schedule that your risk assessment justifies. Triggers include moving equipment, adding a room or rack, changing cooling or power, altering a building or colocation contract, changing who holds keys or access cards, and any incident involving water, heat, smoke or intrusion. The fixed review interval is a decision for your organization, recorded in the ISMS, and the auditor will check that you followed the interval you set. Ask your partner to build the trigger list and review calendar into the process so that the evidence keeps pace with the environment.

What should we ask a provider to confirm before signing a fixed-scope agreement?

Ask the provider to list the sites, rooms and equipment groups in scope, the environmental risks each one will assess, and the evidence it will deliver for each. Confirm which items depend on your landlord, colocation operator or cloud provider and who will obtain those records. Ask what internal time you must commit, which deliverables are final and which need your approval, and how changes to scope will be priced and agreed in writing. Also confirm how the work will hand over to your team so the siting records remain usable after the engagement.

Where organizations fall short on equipment siting

Most A.7.8 findings are not about missing hardware. They come from placement decisions nobody recorded, site risks that never reached the floor plan, and rules that exist on paper but not at the rack or desk. The cards below describe each gap and the check an assessor or internal auditor is likely to make.

Placement with no documented decision

Servers, network gear and workstations often end up where cabling or space was convenient at install time, and nobody records why. An auditor will ask who approved the location and what factors were weighed. Check that each secure room and rack has a siting record covering access, environment and exposure, and that the record is dated and approved by an accountable owner.

Site risk assessment not linked to placement

The risk assessment for a building may identify flood, heat or unrest, yet equipment is still placed on a lower floor or beside a window. A.7.8 expects placement to reflect those identified threats. Trace each high-rated site risk from the assessment to the specific equipment location it affects, and confirm the siting record cites that risk.

Environmental alarms without a response owner

Temperature, humidity, water and smoke sensors are often installed but route to a mailbox or a shared channel that nobody watches after hours. When an alarm fires, no one knows who acts. Confirm each environmental alarm has a named responder, an escalation path and a recorded response, and test that the alert reaches a person outside business hours.

Food and drink rules only on paper

Policies may forbid food and drink near equipment, yet the rule is not posted, not enforced and not visible in the spaces where it matters. Spills and crumbs are a common cause of damage. Walk the server room, comms closets and secure desks, check for signage and supplies, and ask staff what the rule is. Record any exceptions that are formally approved.

Sensitive screens visible from public areas

Monitors showing customer records, patient data or operational dashboards may face windows, lobbies or shared corridors. The control expects a decision about shielding against information leakage, such as repositioning, privacy filters or blinds. Check sightlines from public areas at different times of day, and document the shielding decision for each screen location.

No review when equipment moves

Equipment is relocated during refits, consolidations and vendor swaps, and the siting record is not updated. The new location may lack the environmental or access protection the original decision relied on. Add a review step to moves, changes and new installs that re-checks the siting record, the site risk and the shielding decision before the equipment is powered up.

Where DeployOpen fits for equipment siting and evidence

The organization owns A.7.8, and DeployOpen helps it prove the control. Equipment siting decisions belong to the organization: which rooms hold servers and network gear, how racks are placed away from water, heat sources and public corridors, and who may approach them. DeployOpen's role is to plan and implement the technical side inside the client's own sites or data centers, including environmental monitoring for temperature, humidity and water ingress, access and intrusion sensors where they are in scope, and the logging that feeds them. It also prepares the siting records an assessor will ask for, such as floor plans marked with equipment locations, risk notes for each room, and the configuration of monitoring dashboards and alert thresholds. Only the independent auditor or certification body issues reports or certificates. Nothing in DeployOpen's work substitutes for that assessment.

Before engagement starts, confirm three things in writing: which sites and rooms fall inside the ISMS scope, who in the organization approves siting decisions, and which environmental thresholds the organization has set and can justify. Ask whether the monitoring platform will be self-hosted in the client's network so that alert history stays under the client's control, and whether the scope includes food and drink rules and shielding measures, which are often handled by facilities teams rather than IT. Agree on who keeps the siting register after handover and how often it is reviewed. A fixed-scope agreement should name each record, its owner and its review date, so the evidence does not go stale between the implementation and the audit.

Plan for the points where siting evidence usually breaks down. Monitoring alerts that nobody acknowledges, environmental sensors that were installed but never calibrated, and equipment moved during a refit without updating the register are the common gaps. DeployOpen can configure alert routing, document test results and set up periodic review tasks, but the organization must assign people to act on alerts and sign off changes. Interpret these gaps as a planning decision, not a technical failure. Ask your certification body or auditor early which records they expect for A.7.8, since the depth of evidence they test will shape how much monitoring history and change documentation you need to retain.

How DeployOpen scopes, implements and documents A.7.8

DeployOpen works on A.7.8 Equipment siting and protection as part of a fixed-scope engagement, preparing the systems, configuration and records that show equipment is sited and protected. The organization keeps ownership of its controls, and an independent certification body decides conformity.

How we scope

Agree in writing which sites, rooms, racks and self-hosted platforms fall under A.7.8 before work starts.
Record the environmental threats, unauthorized access paths and shielding needs identified in the site risk assessment.
List the food, drink and monitoring rules, owners and evidence sources that the written scope will cover.

How we build

Configure rack placement, cabinet locks and equipment layout to match the agreed siting decisions for each room.
Set up environmental monitoring for temperature, humidity and access events, with alerts routed to named owners.
Test the protections in place, such as lock enforcement and alarm response, and fix gaps before handover.

How we hand over

Deliver a siting register, environmental and access configuration records, and test results mapped to A.7.8.
Document each procedure in plain language so an assessor can trace the control from policy to observable evidence.
Show the client where its own staff must confirm ownership, sign-off and periodic review of the siting decisions.

How we support

Offer ongoing support as a retainer for changes to equipment, rooms or sites that affect A.7.8 evidence.
Re-run the agreed checks after hardware moves, upgrades or site changes and update the records.
Ask the client to confirm during quoting who maintains monitoring tools and who reviews the alerts after handover.