ISO 27001 Annex A 7.8 Equipment siting and protection

This control is broader than ISM-1036.

ISM-1036 requires multifunction devices (MFDs) to be located in areas where their use can be observed to provide day-to-day oversight and deter misuse. This relates directly to ISO/IEC 27001:2022 Annex A 7.8, which requires equipment to be sited securely and protected, including choosing locations that reduce risk. ISM-1036 is a specific, security-focused siting requirement for MFD visibility, whereas Annex A 7.8 is broader and applies to all equipment and a wider range of protection objectives.

This control is broader than ISM-1109.

ISM-1109 requires wall outlet box covers to be clear plastic so the contents of the outlet box can be visually inspected for tampering or the presence of unauthorised devices. This is a specific physical protection and anti-tamper measure that fits within ISO/IEC 27001:2022 Annex A 7.8 (Equipment siting and protection), which requires equipment to be appropriately protected from physical threats and interference. Annex A 7.8 is broader because it covers many ways equipment and associated infrastructure are protected (location, shielding, physical barriers and other protections), whereas ISM-1109 prescribes one concrete design feature for a particular high-risk access point.

This control is broader than ISM-1116.

ISM-1116 requires organisations to maintain a visible physical gap between TOP SECRET cabinets and non-TOP SECRET cabinets to reduce the likelihood of mix-ups, unauthorised access, or inadvertent disclosure. This relates to Annex A 7.8 because securely siting and protecting equipment includes ensuring security containers (and their placement) are arranged to prevent compromise and support safe handling. Annex A 7.8 is broader, covering secure placement/protection of equipment generally, whereas ISM-1116 prescribes a very specific physical separation measure for TOP SECRET storage.

This control is broader than ISM-1296.

ISM-1296 requires physical security to protect network devices in public areas against tampering, theft, or damage. ISO/IEC 27001:2022 Annex A 7.8 requires equipment to be securely sited and protected, which directly includes securing network devices placed in publicly accessible areas. Annex A 7.8 is broader because it applies to all equipment and locations, whereas ISM-1296 targets the specific risk context of public areas.

This control partially overlaps ISM-0161.

ISM-0161 requires IT equipment and media to be physically secured when not in use to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 7.8 relates by requiring equipment to be sited securely and protected, which helps ensure devices and attached media are not easily accessed or removed when unattended. However, Annex A 7.8 is broader around environmental and placement protections, while ISM-0161 is specifically about securing unused equipment/media (e.g., storage, locking, preventing opportunistic access).

This control partially overlaps ISM-0164.

ISM-0164 requires preventing unauthorised people from observing workstation displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.8 requires equipment to be sited securely and protected, which can include positioning screens away from public sightlines and using physical protections that reduce observation. Annex A 7.8 also covers broader equipment protection (e.g. damage, theft) beyond visual privacy, while ISM-0164 specifically targets unauthorised viewing and keyboard observation.

This control partially overlaps ISM-0216.

Annex A 7.8 requires equipment to be securely sited and protected from unauthorised access and damage. ISM-0216 relates by prescribing that TOP SECRET patch panels be installed in individual TOP SECRET cabinets, which is a specific physical siting and protection requirement for high-classification infrastructure. ISM-0216 is highly specific to a component and classification, while Annex A 7.8 is general and applies to all equipment types and protection contexts.

This control partially overlaps ISM-0810.

Annex A 7.8 requires secure siting and protection of equipment to prevent physical compromise. ISM-0810 relates by mandating that classified systems are secured in facilities that meet the security zone requirements suitable for their classification, which is a direct way of ensuring protected siting. ISM-0810 is more prescriptive and classification-based at the facility level, whereas Annex A 7.8 is a general control not limited to classified systems.

This control partially overlaps ISM-0813.

Annex A 7.8 requires secure siting and physical protection of equipment to prevent unauthorised access or interference. ISM-0813 relates by requiring server rooms, communications rooms and security containers not to be left unsecured, which directly contributes to protecting equipment housed in those locations. ISM-0813 is specifically about maintaining secure states of protective enclosures, whereas Annex A 7.8 also includes considerations of where equipment is placed and protected from physical/environmental hazards.

This control partially overlaps ISM-0870.

ISM-0870 requires mobile devices to be carried or stored in a secured state when not being actively used to prevent unauthorised access. This overlaps with Annex A 7.8 because securely siting and protecting equipment includes ensuring devices are physically protected from theft or tampering when unattended, which is a common risk for mobile devices. However, Annex A 7.8 is about secure placement/protection of equipment generally, while ISM-0870 specifically targets the secured state and handling expectations for mobile devices.

This control partially overlaps ISM-1053.

Annex A 7.8 requires equipment to be sited securely and protected to reduce physical threats and unauthorised access. ISM-1053 relates by mandating that classified servers, network devices and cryptographic equipment be secured in server/communications rooms that meet an appropriate security zone standard for their classification. ISM-1053 is more prescriptive and classification-driven, while Annex A 7.8 applies more generally to equipment siting and protection regardless of classification.

This control partially overlaps ISM-1074.

Annex A 7.8 requires equipment to be positioned and protected to reduce unauthorised access and physical harm. ISM-1074 specifically controls physical access mechanisms (keys/equivalents) to server rooms, communications rooms and security containers that house critical IT infrastructure, directly supporting secure placement and protection of that equipment. ISM-1074 is about access governance, while Annex A 7.8 also covers non-access siting protections (e.g. environmental placement and physical safeguards).

This control partially overlaps ISM-1119.

ISM-1119 requires that cables in TOP SECRET areas are fully inspectable for their entire length to make tampering or illicit taps detectable. Annex A 7.8 requires equipment to be sited securely and protected, which commonly extends to associated infrastructure (including cabling routes and containment) to prevent physical compromise. The overlap is the shared physical-security objective of preventing and detecting physical interference, but Annex A 7.8 is equipment-centric while ISM-1119 is explicitly and narrowly about cable inspectability in TOP SECRET spaces.

This control partially overlaps ISM-1599.

ISM-1599 requires IT equipment to be handled based on its sensitivity or classification. ISO/IEC 27001:2022 Annex A 7.8 requires secure siting and protection of equipment, aiding sensitivity-appropriate handling by mitigating risks of theft or unauthorised access to classified equipment. Annex A 7.8 is focused on physical security rather than classification-based handling processes.

This control partially overlaps ISM-1884.

ISM-1884 requires compliance with ASD emanation security doctrine for the management of emanation security matters. Annex A 7.8 requires equipment to be sited securely and protected, which includes protecting equipment processing confidential information against leakage through electromagnetic emanation. ISM-1884 is a specialised emanation requirement, while Annex A 7.8 also covers environmental and physical risks to equipment.

This control partially overlaps ISM-1973.

Annex A 7.8 requires equipment to be placed in secure locations and protected from unauthorised access and physical/environmental harm. ISM-1973 relates by mandating that non-classified systems be housed in suitably secure facilities, which is a key mechanism for secure siting. ISM-1973 focuses on facility suitability for a system category, while Annex A 7.8 also covers protections beyond facility selection (e.g., placement within rooms, exposure to hazards, and physical safeguards).

This control partially overlaps ISM-1974.

Annex A 7.8 requires that equipment is securely placed and physically protected. ISM-1974 relates by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure server rooms or communications rooms, which is a concrete siting/protection requirement. ISM-1974 is targeted to specific equipment types and locations, while Annex A 7.8 remains broader and may include additional protections (e.g. environmental placement, physical barriers) beyond room selection.

This control partially overlaps ISM-1975.

Annex A 7.8 requires equipment to be sited securely and protected to reduce unauthorised access and physical compromise. ISM-1975 relates by requiring certain non-classified equipment to be secured in suitably secure security containers, which is a protective siting approach at the container level. ISM-1975 is narrower and container-focused for a defined equipment set, whereas Annex A 7.8 also covers broader siting decisions and environmental/physical safeguards.