ISO 27001 Annex A equipment siting and protection (A.7.8)

Picture the first ten minutes of your site audit. The comms cupboard door is propped open, a switch sits under a water pipe, and the reception monitor shows a client list to anyone on the visitor sofa. That is how ISO 27001 Annex A equipment siting and protection gets tested: with eyes, not documents.

This guide is for operations managers, IT leads and security managers at 25–250 person firms. It covers what A.7.8 asks, the walkthrough to run first, how to protect cupboards and racks, how to scope the control when your workloads sit in AWS or Azure, and the sensor and ticket evidence that keeps proof current all year.

What does ISO 27001 Annex A 7.8 require?

ISO 27001 Annex A 7.8 requires you to place hardware that handles company information deliberately: away from passers-by, out of sight of anyone who shouldn't read a screen, and clear of heat, water, dust and power hazards. It also expects a visible line between organisation-controlled hardware and equipment you don't control.

The NIST SP 800-53 Rev. 5 PE-18 control specification states the underlying principle: position system components to limit damage from physical and environmental hazards and to limit the opportunity for unauthorised access. A.7.8 applies that principle to the hardware in your own office, which is why ISO 27001 equipment siting and protection reads as estate management with a security purpose.

The control protects all three pillars of information security at once:

• Confidentiality. Screens, and the signals they emit, that someone could read from the wrong place.
• Integrity. Kit that anyone can reach is kit anyone can tamper with.
• Availability. Heat, water, dust and power problems that quietly kill hardware.

It is a preventive control: sensible placement stops damage, theft and shoulder-surfing before any of them becomes an incident.

Auditors test it with their eyes on the way in from reception: the server humming in an unlocked cupboard, the monitor in full view of the street, the rack under a water pipe. Each finding is cheap for them and embarrassing for you, because it signals that security thinking stops at the software layer. Availability bites hardest at your size, since a leak or an overheating comms room can take the office network down for days.

Enterprise buyers running on-site diligence notice the same exposures, which makes tidy siting a sales asset as well as an audit one.

How do you run the site walkthrough before writing any policy?

Walk the site before writing anything. Tour the office with fresh eyes, noting where servers, switches and network gear live, what hangs above them, who can reach them, and which screens are readable from windows, corridors or the visitor sofa. Photograph everything; the photos become your gap list and your first evidence.

Work through the office in this order:

1. Comms gear. Find every server, switch, router and patch panel, including those in cupboards, under desks and behind reception.
2. What hangs above. Look up for water pipes, AC units and condensate lines.
3. Who can reach it. Note who holds keys or can simply walk in: cleaners, visitors, neighbouring tenants.
4. Readable screens. Stand at the windows, in corridors and on the visitor sofa, and see what you can read.
5. Kit you don't control. Spot visitor devices, landlord equipment and BYO hardware sharing the space.

Photograph each finding with a wide shot and a close one, and file the set with the date. Of everything you can show an auditor at this scale, a dated walkthrough with photographs persuades most, and a second set taken after the fixes gives you the before-and-after story.

A policy written first describes the office you imagine. The walkthrough describes the one you have, and its findings feed your risk assessment directly. If the asset inventory is stale, correct it as you walk, so the locations it records match the floor.

Keep the checklist you used. The recurring review in the final section reuses it, so the first walkthrough becomes the template for every later one, and the dated photo sets show how the layout has changed.

How do you stop screens being read from windows and reception?

Reposition first. Angle monitors that display personal data away from windows, corridors and reception, and fit privacy filters only where a desk cannot be turned. Screen-lock policy covers the remainder. The ICO physical security audit guidance asks for exactly this: devices displaying personal information positioned to reduce the risk of unauthorised access.

Privacy filters are the standard fix when a screen handling sensitive data faces a window or shared space and cannot simply be turned. If repositioning solves the problem, reposition: a filter costs money per device and has to be remembered with every new monitor.

Apply the fixes in this order:

1. Reposition. Turn desks and angle monitors away from glass, corridors and the reception counter.
2. Filter. Fit privacy filters where the layout cannot change, such as ground-floor desks facing the street.
3. Lock. Enforce a short automatic screen-lock timeout, so a screen left unattended at lunch is dark by the time a visitor wanders past.

Test the result the way an auditor would: stand where a visitor stands and try to read the screen. Repeat at different times of day, because daylight and glare change what shows through glass.

Put the desk-layout rule into induction rather than a standalone policy, so new starters learn not to turn a monitor towards the window. The risk is familiarity: staff stop seeing a screen that has faced the pavement for three years.

How do you protect comms cupboards and server racks?

Put anything server-shaped in a lockable, dedicated space: a comms room, or a locked and ventilated cabinet. Limit access to those who need it, log entries, and add a temperature, humidity and leak sensor that alerts someone before hardware cooks. Never use the cleaning cupboard, or a desk, as a server room.

For a 50-person firm, we recommend a standard with four parts:

• Dedicated space. A comms room, or a locked, ventilated cabinet where no room exists.
• Limited access. Keys or codes only for people who need them, plus a record of who went in.
• Environmental sensing. Temperature, humidity and leak detection that alerts a named person.
• House rules. No drinks on the switch cabinet and no kit left running under desks, covered in induction.

The ICO physical security audit guidance points the same way, listing humidity sensors and physical access detection among the controls to implement.

Access records can start low-tech. A signed sheet inside the door answers "who went in last Tuesday?" until a smart lock replaces it, and the question matters more than the mechanism.

Sensors earn their cost at weekends. An overheating comms room on a Saturday takes the office network down until Monday unless an alert reaches a phone, so route alerts to a channel someone owns.

A control that claims environmental monitoring but pages nobody is a finding waiting to be sampled.

Three classic failures are worth checking for in the walkthrough:

• The server under a desk or in the cleaning cupboard, the scale-up leftover nobody re-homed.
• Racks beneath water pipes or AC condensate lines with no leak detection, discovered the wet way.
• Office HVAC trusted to cool the comms room, with no sensor to say when it stops.

A lock, a sensor and a log cost little, and together they cover the three ways kit gets lost: theft, tampering and heat.

What about public-facing kit and hardware you don't control?

Keep company-managed hardware physically apart from visitor devices, landlord building systems and anything BYO, so the boundary of your estate is visible; this separation is the notable 2022 addition. Equipment that must sit in public reach, such as a reception kiosk or demo unit, is anchored, with unused ports disabled.

Three groups usually sit on the wrong side of the boundary:

• Visitor devices. Laptops and phones on guest Wi-Fi or plugged into meeting-room ports.
• Landlord systems. Building access panels or risers sharing your cupboard.
• BYO hardware. Personal or contractor devices that staff bring in.

Separation can be modest: a guest network that never touches the office switches, a separate cabinet or labelled shelf for landlord kit, and no personal devices plugged into company ports. Whatever you choose, an auditor standing in the room should be able to see the boundary.

Shared offices deserve extra attention. A tenant in a serviced building shares corridors, meeting rooms and sometimes cupboards, so ask the landlord which areas you control and record the answer in the walkthrough. Hosting a partner's demo hardware or a contractor's own laptop is the situation most likely to blur the line, so decide where such kit may sit before it arrives.

Equipment in public reach is allowed, with conditions:

• Anchor it to a desk, wall or stand.
• Shut down unused ports, so a USB stick or cable has nowhere to go.
• Lock the device down into a restricted mode.
• Supervise it by CCTV or line of sight.

A kiosk with open ports and a loose cable is an invitation, and the fixes cost less than the conversation about it.

How does ISO 27001 Annex A 7.8 apply to cloud-first organisations?

Annex A 7.8 still applies, scoped down. Laptops, office switches, routers and screens are equipment, so they stay in scope; the data-centre-grade measures belong to your cloud provider, and your Statement of Applicability should say so rather than scoping the control out. Co-located racks remain your responsibility.

In a cloud-first office, these stay in scope:

• Laptops and desktops used in the office.
• Switches, routers, access points and patch panels.
• Monitors and other peripherals that display or handle company information.
• Anything in the comms cupboard, including a leftover server nobody retired.

For the cloud estate, cite the provider's physical security assurance in the SoA, the register recording which Annex A controls apply and how, and state that data-centre siting is the provider's responsibility. The entry becomes a reference rather than a gap, and the auditor sees a scoped decision instead of an omission.

Co-located racks are the exception. The NPSA guidance on data hall and equipment security is blunt: however secure the data centre, the customer is responsible for limiting who can reach its networking equipment. Rack-level locks, an access list you control and a way to detect unauthorised access to your rack remain yours to evidence.

Over-engineering is the opposite error. Pricing gas fire suppression or dedicated cooling for a cupboard holding two switches wastes budget that sensors and sight-line fixes would spend better, and a firm whose production runs entirely in AWS has no case for either. Scale up only if you genuinely run on-prem workloads.

Proportion looks like this: a 30-person firm with one cupboard needs a lock, a sensor and a walkthrough ticket. A 250-person firm across two offices needs the same pattern per site, plus a register showing which cabinet serves which team.

What do auditors sample during the site tour?

Auditors verify A.7.8 by walking the floor. They ask to see the comms room, look up for pipes and down for clutter, test sight-lines from the visitor area, and cross-check inventory entries against where hardware actually sits. Whatever your Statement of Applicability claims, the walkthrough is the test.

Expect questions like these in the room:

• "Where does your network and server hardware live, and who can get to it?"
• "How would you know if the comms room got hot or wet over a weekend?"
• "Which screens in this office can a visitor read, and what have you done about it?"
• "How do you keep company-managed kit separate from devices you don't control?"
• "When did you last walk the site looking for exactly these problems?"

Environmental claims get tested, not just read. Be ready to show sensor readings, the alert configuration and an example alert that fired, or to trigger one while the auditor watches.

The inventory cross-check is quiet but pointed. The auditor picks two entries and goes to find the hardware, so a switch recorded in the comms room but sitting under a desk is a mismatch even when every other control is sound.

Certification bodies typically grade what they find along these lines:

• Major: critical hardware in an unlocked, unmonitored space, or a stated control such as environmental monitoring that demonstrably isn't running.
• Minor or opportunity for improvement: a single exposed screen or an untidy cabinet.
• Escalation: several minors can aggregate into a major as a pattern of casual physical handling.

Bring the records in the evidence table below, plus your induction material on equipment house rules. Together they answer most of these questions before they are asked.

How do you implement ISO 27001 Annex A equipment siting and protection as continuous evidence?

Automate the monitorable half. Networked temperature, humidity and leak sensors generate readings and alert logs; a smart lock on the comms room produces an exportable access log; a recurring walkthrough ticket with photos attached proves the review keeps happening. People still decide where equipment goes.

Each stream replaces a pre-audit scramble with a running record. Sensor history shows the environment is watched, the lock log shows who entered, and the ticket history shows the review recurs after desks move and floors are rearranged.

The automation's job is to notice when conditions drift. Judgement stays with people: where equipment goes, what a visitor can see, and whether a new desk plan has turned a screen towards the window. These small, always-on evidence pipelines are the kind of work GRCMANA's GRC engineering service builds.

Build the walkthrough ticket once. Attach the checklist from your first tour, add a photo field for each item, assign an owner, and set it to recur every quarter and after any office move or refit.

A walkthrough done once, at certification, is a photograph of a layout that no longer exists.

Run this way, the annual audit becomes a read-out of records that already exist. At 25–250 people, that cadence satisfies certification bodies and enterprise buyers doing on-site diligence.

Frequently asked questions