What does 7.8 require?

Equipment is to be positioned securely and protected. Purpose (stated in ISO/IEC 27002:2022): lessens exposure of equipment to physical and environmental hazards and to tampering or harm. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.8.

ISO 27001:2022 7.8: Equipment siting and protection

What else in your programme already covers this

This control maps to 33 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 6 controls

9.2.1 9.2.1 Facility entry controls for CDE systems
9.2.1.1 9.2.1.1 Monitoring of entry to sensitive areas
9.4.1.1 9.4.1.1 Secure storage location for offline backups
9.5.1 9.5.1 Protection of POI devices from tampering
9.5.1.1 9.5.1.1 Current register of POI devices
9.5.1.2 9.5.1.2 Periodic inspection of POI device surfaces

CMMC 2.0 · 4 controls

MA.L2-3.7.3 Equipment Sanitization
MP.L2-3.8.9 Protect Backups
PE.L2-3.10.1 Limit Physical Access
PE.L2-3.10.2 Monitor Facility

NIST SP 800-53 Rev 5 · 4 controls

NIST800-PE-16 PE-16 Delivery and Removal
NIST800-PE-18 PE-18 Location of System Components
NIST800-PE-20 PE-20 Asset Monitoring and Tracking
NIST800-PE-23 PE-23 Facility Location

FedRAMP High · 3 controls

PE-14 Environmental Controls
PE-5 Access Control for Output Devices (PE-5)
PE-9 Power Equipment and Cabling (PE-9)

FedRAMP Moderate · 3 controls

PE-14 Environmental Controls
PE-5 Access Control for Output Devices (PE-5)
PE-9 Power Equipment and Cabling (PE-9)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-DCS-13 Environmental Systems
CCM-DCS-15 Equipment Location

ISO 27701:2019 · 2 controls

6.8 Physical and environmental security
6.8.2 Equipment

SOC 2 · 2 controls

SOC2-A1.2 A1.2 Environmental protection, backup and recovery infrastructure
SOC2-CC6.4 CC6.4 Restricting physical access to facilities and assets

C5 (Germany) · 1 control

C5-PS-01 Physical Security and Environmental Control Requirements

COBIT 2019 · 1 control

DSS01.04 DSS01.04 Manage the environment

HIPAA Security Rule · 1 control

164.310(c) Workstation Security (Standard)

ISO 27001:2013 · 1 control

A.11.2.1 Equipment siting and protection

ISO 27002:2022 · 1 control

7.8 Equipment siting and protection

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.IR-02 The organization's technology assets are protected from environmental threats

NIST SP 800-66 Rev 2 · 1 control

164.310(c) Workstation Security (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 7.8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gaps If you hold ISO 27001:201383.9% covered · 15 gaps If you hold FedRAMP Moderate80.6% covered · 18 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gaps If you hold C5 (Germany)69.9% covered · 28 gaps If you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free

ISO 27001:2022 7.8: Equipment siting and protection