It can be placed in any file.
However, don't just use it everywhere without thinking - too much locking can be just as bad as not enough locking.
In particular, be careful not to create deadlocks (by placing competing locks that might both end up waiting for the other to complete, meaning neither of them can process).
There is useful info (including some good links) here: How to make a shared resource thread-safe when using dependency injection?
You can also look at questions tagged with both coldfusion and locking for more interesting reading: https://stackoverflow.com/questions/tagged/coldfusion+locking