Equipment is to be positioned securely and protected. Purpose: lessen exposure of equipment to physical and environmental hazards and to tampering or harm. Guidance: consider placing equipment so that people do not need to pass through work areas unnecessarily and unauthorized access is avoided; positioning facilities that handle sensitive data so unauthorized people cannot view information while they are in use; protection from physical and environmental threats, for example theft, fire, explosives, smoke, water or loss of water supply, dust, vibration, chemicals, disturbance to power or communications, electromagnetic radiation and deliberate damage; rules on eating, drinking and smoking near processing facilities; monitoring temperature, humidity and other conditions that could harm operation; lightning protection on all buildings with filters on incoming power and communication lines; special protection such as keyboard membranes in industrial settings; protecting equipment that handles confidential information against leakage through electromagnetic emanation; and physically separating facilities the organization manages from those it does not.
This control maps to 32 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 7.8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 32 it maps to, and the evidence behind each claim, over MCP and REST.