---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.7.8"
title: "Equipment siting and protection"
theme: Physical
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts: [Protect]
operational_capabilities:
  - Physical_security
  - Asset_management
security_domains: [Protection]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 7.8 Equipment siting and protection

  

### Control

  

Equipment should be sited securely and protected.

  

### Purpose

  

To reduce the risks from physical and environmental threats, and from unauthorized access and damage.

  

### Guidance

  

The following guidelines should be considered to protect equipment:

  

a\) siting equipment to minimize unnecessary access into work areas and to avoid unauthorized access;

  

b\) carefully positioning information processing facilities handling sensitive data to reduce the risk of information being viewed by unauthorized persons during their use;

  

c\) adopting controls to minimize the risk of potential physical and environmental threats \[e.g. theft, fire, explosives, smoke, water (or water supply failure), dust, vibration, chemical effects, electrical supply interference, communications interference, electromagnetic radiation and vandalism\];

  

d\) establishing guidelines for eating, drinking and smoking in proximity to information processing facilities;

  

e\) monitoring environmental conditions, such as temperature and humidity, for conditions which can adversely affect the operation of information processing facilities;

  

f\) applying lightning protection to all buildings and fitting lightning protection filters to all incoming power and communications lines;

  

g\) considering the use of special protection methods, such as keyboard membranes, for equipment in industrial environments;

  

h\) protecting equipment processing confidential information to minimize the risk of information leakage due to electromagnetic emanation;

  

i\) physically separating information processing facilities managed by the organization from those not managed by the organization.

  

### Other information

No other information.