ISO 27001 A.7.5: Protect against physical and environmental threats

What A.7.5 requires in practice

Annex A control 7.5 asks the organisation to design and put in place protection against physical and environmental threats. The standard gives natural disasters as examples, together with other threats to infrastructure that are either deliberate or accidental. In practice, that means fire, flooding, severe weather, damage from neighbouring activity and malicious physical acts. The control does not ask for a generic list of hazards; it asks for protection that is designed for the site. The parts are therefore to understand what would be harmed and how, to identify credible exposures at each location, to choose safeguards that interrupt the damage pathway, and to confirm that they work. The outputs are an assessment of threats to the premises and equipment, safeguards proportionate to them, and records of checks. The standard does not give an engineering specification or require identical safeguards at every site.

Start with consequences and credible exposure

Identify the information assets, services and physical dependencies that could be affected. Original records may have different recovery options from replicated digital information. A local network room can be critical even when the applications it connects to run in the cloud. Consider whether one event could affect several dependencies at the same time.

Examine location, construction, neighbouring activities and relevant changes. The assessment should consider credible threats without pretending every possible event has equal significance. Appropriate facilities, safety or engineering specialists may be needed to assess the exposure and available protection. Record assumptions clearly, especially when information from a landlord or provider is incomplete.

Choose safeguards for the threat pathway

A useful decision explains how the event could affect the asset and where protection interrupts that pathway. Relocating an activity, modifying the surrounding arrangement, improving detection or providing suitable physical protection can address different parts of the problem. Selection should reflect competent advice and applicable requirements, rather than an assumption that one purchased device solves every scenario.

Detection also needs action. If a warning is intended to prompt intervention, define the responsible recipient and the authorised response. This guide does not prescribe fire suppression, electrical work or emergency procedures. Those decisions require the actual premises and qualified expertise. Security protection must be coordinated with safe working and emergency arrangements.

Why protection against physical threats matters to the business

A fire, flood or storm can stop operations and destroy records in a single event, and the cost usually falls on availability, recovery and customer trust. Organisations that have thought through credible threats can often choose inexpensive steps in advance, such as moving equipment away from a leak path, and avoid emergency spending later. Customers with continuity requirements examine whether your sites are protected and what depends on them. Insurers and landlords also look at these arrangements. At audit, a site-specific assessment that clearly links threats to safeguards is much more convincing than a standard hazard list copied from a template.

How to implement A.7.5

Keep the assessment tied to the real buildings and what they hold. Where the organisation shares a building, ask the landlord for the information it holds, and record what you were told. Keep the written assessment short enough that people will actually update it.

1. List the information assets, services and equipment housed at each site, and note which could not easily be replaced.
2. Identify credible threats for each site, considering location, construction, neighbours and recent changes.
3. Check whether one event could affect several dependencies at once, such as a single room hosting both equipment and records.
4. Involve facilities, safety or engineering specialists where the exposure needs expert judgment.
5. Choose safeguards that interrupt the damage pathway, for example relocation, protective arrangements or detection and response.
6. Obtain information from landlords and providers about the protection they supply, and record any assumptions made.
7. Review the assessment when premises, layout or activities change, and keep a record of what was decided.

Illustrative IT example: water above a network cupboard

Illustrative manufacturing example: renovation beside control equipment

A hypothetical manufacturer schedules building work beside a room holding production-support computers and sensitive process records. Dust and changes to surrounding access could affect equipment reliability and information protection. The construction contractor's programme does not initially identify those business dependencies.

Before work begins, operations, IT and facilities agree an assessed separation arrangement and suitable checks, with competent advice on equipment conditions. The project identifies who can approve changes and when work must be reviewed because conditions differ. Evidence includes the interface assessment, communicated restrictions and observations during the renovation. The example shows how an ordinary temporary project can change environmental exposure without a natural disaster occurring.

Connect protection with continuity planning

Reducing the likelihood or effect of physical damage is different from restoring a service after disruption. Both can be needed. Supporting utilities, backup arrangements and ICT continuity readiness address related dependencies. A backup stored beside the original equipment may be exposed to the same event; a recovery arrangement should be evaluated on its own terms.

Do not substitute insurance for the control decision. Financial cover may affect the business response, but it does not itself protect confidentiality, preserve records or keep a service available. Similarly, a landlord's general inspection certificate may not address the particular information asset or dependency identified by the organisation.

Evidence and review that remain useful

Common nonconformities with A.7.5

Auditors tend to find that threat protection is generic. The common thread is assessment that was not tied to the real site, which auditors identify by asking how a given safeguard was chosen.

• A hazard list that is not tied to the actual location or construction of the premises.
• Critical equipment housed beneath pipes or in rooms with obvious water or fire exposure.
• Reliance on a landlord's assurances with no check of what is actually provided.
• Original paper records stored with no consideration of damage or recovery.
• An assessment completed once and never revisited after a move or refit.