Equipment siting and protection

Plain-language summary

Placing and protecting equipment so it is safe from physical and environmental harm and from unauthorised access or viewing — servers, network gear, shop-floor PCs and printers sited where heat, dust, water, impact and prying eyes cannot reach them.

What the clause is really asking

Where equipment sits decides much of its risk, and this control asks you to choose locations and protection for it with security in mind. The considerations are physical and environmental: keeping equipment away from heat, dust, water, vibration, chemicals and electrical interference; controlling temperature and humidity; protecting against theft and tampering; positioning screens and printers so sensitive information cannot be seen by people who should not see it; keeping food and drink away from critical equipment; and lightning or surge protection where needed. The misunderstanding is that only the data centre counts. In manufacturing the harsh environment is on the production floor: network switches in cabinets beside a moulding line, PCs exposed to dust and heat, routers mounted where a forklift can hit them, and machine controllers holding programmes and recipes. These need enclosures, cooling, guards and locks as much as servers do. An ISO 9001 practitioner will recognise the link with infrastructure and the environment for operating processes; the engineers who site production equipment should be involved.

What auditors look for

Auditors visit the server room, network cabinets and a sample of equipment on the shop floor and in offices. They look for heat, dust, water and impact risks, check temperature and humidity monitoring, and see whether cabinets are locked. They note screens visible from public areas, printers in corridors and equipment under pipes. They ask how the siting of new equipment is approved and check environmental alerts. The hard question: what is the temperature in your server room right now, and who gets told if it rises?

Typical evidence

Equipment siting standard; inventory showing location of critical equipment; temperature and humidity monitoring with alert settings and logs; locked cabinets and enclosures; impact protection for floor-mounted equipment; surge protection; inspection records for server and network rooms; approval records for new installations.

How to comply — recommendations

Write a half-page equipment siting standard covering temperature, dust, water, impact, locking and screen visibility, and apply it to every new installation. Survey what you have: the server room, each network cabinet and a sample of shop-floor PCs. Fix the worst first: locked, ventilated enclosures on the floor, barriers or bollards where forklifts operate, and temperature sensors in the server room that alert a person. Turn screens away from windows and reception. Add equipment siting to the change process so engineering and IT agree before anything is installed. Inspect quarterly alongside the facilities checks.

Common nonconformities

Server room without temperature monitoring or alerts; equipment under water pipes or standing on the floor; network cabinets unlocked or exposed to dust and impact on the production floor; screens showing sensitive information visible to visitors; food and drink beside critical equipment; no surge protection; new equipment installed without any siting review.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.