ISO 27001 Control A.7.5: Protecting Against Physical and Environmental Threats

Most conversations about information security are about people, software and networks. A flooded basement, a fire in the next unit or a heatwave that takes out the air conditioning can end an organization’s access to its information just as thoroughly as ransomware, and often with less warning. A.7.5 asks you to think about those threats deliberately. It is the fifth of 14 physical controls in our walk through Annex A.

The control is not asking you to build a bunker. It asks you to understand which physical and environmental threats are realistic for your sites, and to put safeguards in place that are sensible for the value of what they protect. A small consultancy whose data lives in cloud services faces a very different picture from a company running its own server room.

What the control requires

Annex A control 7.5 of ISO 27001:2022 states that protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure, shall be designed and implemented.

The key elements:

Physical and environmental threats - fire, flood, storm, earthquake, lightning, explosion, civil unrest and similar hazards, whether natural or man-made
Intentional or unintentional - deliberate acts such as sabotage and vandalism, and accidents such as a burst pipe or an electrical fault
Infrastructure - the buildings, equipment and facilities that your information and systems depend on
Designed and implemented - protection is planned from a risk assessment and then actually put in place

A.7.5 is a preventive control - it reduces the likelihood and the impact of physical events before they happen. Annex A states the control; ISO 27002 gives guidance on carrying out the risk assessment first and then choosing measures. That order matters: the standard expects you to assess the threats, not to apply a generic checklist.

How to implement protection against physical and environmental threats

Assess the threats for each location

Begin with a site-by-site view. For each location that holds or supports information, ask what could realistically go wrong: is the building in a flood zone, near a river or on a low floor; is the region prone to earthquakes, storms or extreme heat; is there a neighbouring business that stores hazardous materials; are there political or civil risks nearby? Local authorities, insurers and landlords can often provide hazard information for free.

Feed the results into your information security risk assessment as ordinary risks with an owner, a likelihood, an impact and a treatment decision. This keeps physical threats in the same register as everything else rather than in a separate facilities document nobody reads.

Choose proportionate safeguards

Typical measures include:

Fire detection and suppression suited to the room, such as gas suppression for a server room rather than water sprinklers over equipment
Water detection under raised floors, and keeping equipment off ground floors and away from pipework where possible
Temperature and humidity monitoring with alerts, and resilient cooling for equipment rooms
Surge and lightning protection on power and network lines
Physical protection against vehicle impact, vandalism or forced entry at exposed points
Safe storage for backups and key records away from the primary site

Not every measure belongs in every organization. The question is whether your safeguards match the risk you found and the value of what is at stake. Where you rely on a cloud or colocation provider, much of this moves to their data centre, and your responsibility becomes confirming that their assurance - an ISO 27001 certificate, a SOC 2 report - covers the facility you actually use.

Keep people safe and plan for the event

Safeguards are only half the story. Fire doors, evacuation routes and assembly points, trained fire wardens and regular drills protect the people first, and their safety always comes before equipment or data. Document what staff should do when an alarm sounds, including how to leave secure areas safely without leaving them unprotected afterwards.

Then connect the threat to recovery. If the site is lost for a week, how does the business carry on? That is the territory of business continuity and ICT readiness, and the answers - alternative locations, remote working, restorable backups - should be written down and tested. Our post on remote working covers one common fallback.

Maintain and test what you install

Detection and suppression equipment degrades. Extinguishers need servicing, batteries in alarm panels fail, and sensors get painted over during refits. Set a maintenance schedule, keep the service records, and run periodic tests. Review the threat assessment when you move, expand, change a room’s use or when the local picture changes, for example after a nearby flooding event.

A.7.4 connection. Physical security monitoring is how many environmental problems, such as a forced exit or an alarm trigger, are detected in the first place.

A.7.3 connection. Securing offices, rooms and facilities shapes where sensitive equipment sits, which determines its exposure to water, heat and fire.

A.7.1 connection. Physical security perimeters form the outer layer that also stands between your infrastructure and external hazards.

Forward references. Equipment siting and protection, supporting utilities and cabling security each deal with specific environmental exposures in more detail; we cover them later in the Annex A series.

Clause 6.1 connection. Clause 6.1, Actions to address risks and opportunities, is where the assessment-then-treatment approach comes from, and where physical threats belong alongside every other risk.

What auditors check

A documented threat assessment. Auditors look for evidence that you considered the specific hazards for each site, not a copied list of generic risks.

Safeguards that match the findings. If the assessment names flooding, they expect to see what you did about it. If it names fire in the equipment room, they expect to see suitable detection and suppression.

Maintenance and test records. Fire equipment servicing, alarm tests, UPS and cooling checks and evacuation drills show that protection is ongoing.

Reliance on third parties. For hosted or colocated systems, they ask how you obtained assurance about the provider’s physical and environmental protections.

Recovery arrangements. They look at whether the consequences of losing a site are understood and whether continuity plans reflect the threats you identified.

Walk-through observations. On site, auditors notice practical details: equipment stored on the floor of a basement, a server room with water pipes overhead, blocked extinguishers or propped fire doors.

Common mistakes to avoid

Skipping the assessment. Buying equipment first and justifying it later leads to safeguards that do not match real risks.

Treating it as a facilities matter only. Information security owns the risk to information, so the facilities team and the ISMS need to work from the same register.

Water sprinklers over server equipment. Suppression has to suit what it protects, and the wrong choice can do more damage than the fire.

Untested safeguards. Alarms never tested, backup power never exercised and sensors never checked will fail when it matters.

Assuming the cloud removes the question. Moving to a provider shifts the location of the risk. You still need assurance, and you still need to protect offices, laptops and local backups.

Forgetting people safety. Drills and evacuation routes are part of the picture, and they must work without leaving sensitive areas exposed.

How 27kay can help

We help organizations take a clear-eyed look at the physical risks to their sites and choose measures that fit, without gold-plating or a generic checklist. As part of ISO 27001 implementation, we run the threat assessment with you, connect it to your risk register and continuity plans, and prepare the evidence an auditor will look for. For the full picture, see our ISO 27001 knowledge hub.

If your main office were unusable tomorrow morning, would you know what you had lost and how you would carry on? Get in touch - we will help you work through it before it happens.