Control A.7.5Protecting against physical and environmental threats
Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure, must be designed and implemented.
Fire, water, power, temperature, and the deliberate physical threats that vary by location and by what the organisation does. The control asks for the threats relevant to each site to be identified and addressed — which requires knowing the site: what is above the server room, what the building’s fire suppression will do to equipment, where the water enters.
Fire is where the tension in this control is sharpest. Life safety governs and overrides information security, and the arrangements have to be designed with that order of priority — a fact worth stating explicitly in the risk assessment so it is not rediscovered as a conflict.
The threats also change. Flood risk in particular has moved for many locations, and a site assessment made a decade ago may describe a hazard profile that no longer holds.
How to put this in place
Fire, flood, power surges and similar hazards can stop an ISMS service as surely as an attack. The project needs these threats assessed per site, with landlord duties confirmed rather than assumed.
- Assess the physical and environmental threats at each site in scope.
- Decide the protection needed, such as fire detection, water detection and surge protection.
- Install or confirm it, asking the landlord for proof of what they provide.
- Place critical equipment away from obvious hazards, such as water pipes.
- Test and inspect on a schedule and keep the records.
Evidence an auditor usually looks for: a site risk assessment, fire system test records, and landlord confirmations of the protection they provide.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.