Key takeaways
- Place and protect equipment to reduce physical risks and unauthorised access.
- Where and how equipment sits affects its exposure to damage, theft and overlooking.
- Start here: position equipment away from environmental hazards and public view.
Purpose
Place and protect equipment to reduce physical risks and unauthorised access.
Requirement
Requirement summaryEquipment shall be sited securely and protected.
Why it matters
Where and how equipment sits affects its exposure to damage, theft and overlooking.
How to implement
- Position equipment away from environmental hazards and public view.
- Secure equipment against theft where needed.
- Protect cables and network ports.
- Review siting when moving offices.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.8. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for where equipment is placed and how it is protected.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.8 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list or plan of where key equipment is located.
- Notes on protections in place, such as locked racks, privacy screens or raised floors.
- Maintenance records for protective equipment.
- Records of any damage or incidents involving equipment.
Things you should be able to show or explain
- Be able to show that equipment is away from public view and protected from damage.
How much to show: Key equipment locations.
Common mistakes
- Equipment in public areas.
- Screens visible to visitors.
- Screens facing windows on the ground floor.
- Network ports open in public areas.
- Tip: Keep printers with sensitive output in controlled spots.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.8 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.8?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for where equipment is placed and how it is protected…