All 93 controls · Physical controls
Control 7.8
Equipment siting and protection
What ISO/IEC 27002:2022 control 7.8 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Equipment is to be positioned securely and protected. Purpose: lessen exposure of equipment to physical and environmental hazards and to tampering or harm. Guidance: consider placing equipment so that people do not need to pass through work areas unnecessarily and unauthorized access is avoided; positioning facilities that handle sensitive data so unauthorized people cannot view information while they are in use; protection from physical and environmental threats, for example theft, fire, explosives, smoke, water or loss of water supply, dust, vibration, chemicals, disturbance to power or communications, electromagnetic radiation and deliberate damage; rules on eating, drinking and smoking near processing facilities; monitoring temperature, humidity and other conditions that could harm operation; lightning protection on all buildings with filters on incoming power and communication lines; special protection such as keyboard membranes in industrial settings; protecting equipment that handles confidential information against leakage through electromagnetic emanation; and physically separating facilities the organization manages from those it does not.
Purpose in the standard’s terms, in our words: Lessens exposure of equipment to physical and environmental hazards and to tampering or harm.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Asset management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Floor plans showing equipment placement that limits access and overlooking of sensitive screens
- Environmental monitoring records for temperature and humidity with alert thresholds and responses
- Lightning protection and surge filter installation records for buildings and incoming lines
- Rules on food, drink and smoking near processing facilities
- Assessments of electromagnetic emanation risk for equipment handling confidential information, where applicable
- Evidence of physical separation between organization-managed facilities and third-party equipment, for example in shared rooms
Where audits commonly find gaps
- Screens handling sensitive data face windows or public walkways
- No environmental monitoring exists in small server rooms or cupboards
- Organization equipment shares an unsegregated rack or room with third-party equipment
- Protection against water leaks from overhead pipes is not considered
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.2.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.