7.8 Equipment siting and protection
Requires equipment to be sited securely and protected. Older source material in the folder expands this as siting equipment to reduce unnecessary access into work areas, positioning and restricting the viewing angle of f
5
artefacts
1
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Environmental monitoring records for areas holding sensitive equipment · SIEM / log platform
periodic reviewEvidence produced at each review
- Evidence of viewing angle and screen positioning control where sensitive information is displayed · Document repository
- Evidence of isolation for items needing special protection, and of protection against hazards such as fire, water, dust, vibration and electrical interference · Document repository
- Rules on eating, drinking and smoking near equipment, and evidence of their enforcement · Document repository
governing documentDocuments that govern the control
- Siting records or floor plans showing equipment placement and the reasoning, including restriction of unnecessary access to work areas · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Screens in reception areas, open plan seating and meeting rooms visible to visitors and to windows
- Equipment relocated during office churn with no reassessment of the original siting decision
- Environmental hazards such as water pipes above equipment rooms never identified
- Protection assessed for the data centre while the equally sensitive equipment in offices is ignored
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.7 Clear desk and clear screen · 7.9 Security of assets off-premises