ISO 27001 Physical and Environmental Threats: Control A.7.5

ISO/IEC 27001 control A.7.5 addresses protection against physical and environmental threats. It is broader than installing fire detection in a server room. Organisations need to understand the hazards around each relevant location, select layers of protection and show that those measures remain effective as sites, climate exposure, occupancy and dependencies change.

The control can apply to offices, data centres, warehouses, laboratories, remote equipment, archive areas and critical supplier facilities. The depth of treatment should follow information-security risk and business dependency.

Use the current control structure

Older material may refer to protection against external and environmental threats as A.11.1.4 in ISO/IEC 27001:2013. In the 2022 Annex A structure, protection against physical and environmental threats appears at A.7.5.

Related controls cover physical security perimeters, entry, monitoring, secure areas, clear desk and screen, equipment siting, off-premises assets, storage media, supporting utilities, cabling and equipment maintenance. Business continuity, incident response and supplier controls may also contribute.

Do not treat the renamed control as a documentation exercise. Revisit the actual hazards, assets and sites, then update the Statement of Applicability and treatment records. The Annex A control lookup helps place A.7.5 in this wider control system.

Define the locations and dependencies in scope

Start with the services and information that matter, then identify the physical locations and utilities on which they depend. Include occupied premises, shared buildings, colocated infrastructure, communications rooms, storage sites and equipment placed outside normal facilities.

For each relevant location, capture:

• services, information and equipment supported;
• accountable business, facilities and technology owners;
• building and surrounding-area characteristics;
• power, cooling, water, communications and access dependencies;
• landlord, provider and emergency-service responsibilities;
• hours of occupation and unoccupied periods;
• recovery alternatives and acceptable interruption; and
• prior incidents, near misses and known local hazards.

This creates a service-oriented view. A small communications room may deserve more attention than a larger office if its loss disconnects a critical operation.

Assess natural and human-caused threats

Use reliable local information and site observation. Relevant threats may include:

• fire, smoke and heat;
• flood, surface water, leaks and drainage failure;
• severe weather, wind, lightning or temperature extremes;
• seismic or ground movement where relevant;
• dust, contamination, corrosive material or industrial hazards;
• utility interruption or unstable supply;
• vehicle impact, construction activity or neighbouring operations;
• civil disturbance, malicious damage and forced entry;
• explosion or hazardous-material release; and
• pests or other conditions that can damage equipment and cabling.

Consider both likelihood and consequence. A rare event can justify treatment where service impact or safety consequences are severe. Also consider combinations: a storm may interrupt power, limit physical access and disrupt telecommunications at the same time.

The threat and vulnerability catalogue guide explains how catalogues support discovery while local scenarios and evidence determine the actual risk.

Inspect the site, not only its paperwork

Walk through the location with facilities, security, technology and business representatives. Plans may not show a water pipe above a cabinet, blocked drainage, stored combustible material, construction beside a perimeter or a door routinely held open.

Observe how the facility operates during normal work, maintenance and delivery. Ask what changes when the site is unoccupied. Examine roof and lower-floor exposure, neighbouring tenants, loading areas, external equipment, emergency routes and access for responders.

Record findings with a location, owner and action. Photographs can support evidence when permitted, but they should be protected because they may reveal sensitive layouts and safeguards.

Select layered treatment

Effective protection usually combines avoidance, resistance, detection, response and recovery.

Layer	Decision	Example evidence
Avoid	Can the asset or service be located away from the hazard?	Site decision, relocation record, architecture choice
Resist	What construction or equipment limits damage?	Fire rating, enclosure specification, flood barrier record
Detect	How will the organisation know the condition is developing?	Sensor design, alert route, maintenance and test result
Respond	Who acts, with what authority and safety limits?	Procedure, callout record, exercise or incident evidence
Recover	How will the service continue or be restored?	Recovery design, alternate site, restore or failover result

Not every layer is required for every threat. Select measures using the risk decision and the service’s tolerance. A detector without a response route may only record the failure; a backup site exposed to the same regional hazard may not provide meaningful recovery.

Coordinate physical security, technology and continuity

Facilities teams may manage building systems while technology teams own equipment and service recovery. Define their handoffs. For example, a water sensor alert may go to building security, but the technology owner must know when to shut down equipment or invoke recovery.

Link physical events to the information-security incident process where confidentiality, integrity or availability may be affected. Preserve timelines, decisions, communications and lessons.

The data-centre security controls guide explains how physical safeguards, utilities, operations and supplier assurance come together in high-dependency facilities.

Protect equipment at its actual location

Control A.7.8 covers equipment siting and protection and often supports A.7.5. Keep important equipment away from obvious water, heat, dust and impact exposure where possible. Use cabinets, mounting, enclosures, spacing, cooling and protection suited to the environment.

Distributed devices deserve attention. Network cabinets, warehouse terminals, cameras, sensors and edge systems may operate in uncontrolled or harsh areas. The equipment siting and protection guide provides a detailed method for those decisions.

Supporting utilities need their own analysis. Confirm capacity, maintenance, fuel or battery needs, alarm routing and dependencies. Test generators, uninterruptible power, cooling failover and communications alternatives at a level appropriate to risk. A maintenance certificate alone does not prove that a utility supports the required service duration.

Manage shared and supplier facilities

For leased buildings, colocation and cloud infrastructure, clarify which threats and controls belong to the organisation, landlord or provider. Obtain evidence that addresses the actual service and location, not only a broad corporate assurance statement.

Useful supplier evidence may include responsibility schedules, facility assurance reports, maintenance summaries, incident notifications, recovery-test results and contract terms for access or relocation. Identify any control the organisation cannot inspect directly and decide how it will gain sufficient assurance.

Also consider concentration. Two suppliers or sites may depend on the same power grid, communications route, floodplain or regional workforce. Geographic separation on a map does not prove independence.

Test whether safeguards operate

Use a risk-based sample of locations and threats. Include a critical site, a smaller distributed location and an outsourced facility where relevant. Combine document inspection, observation, interviews and functional evidence.

Useful audit questions include:

• Which local data and site observations informed the risk assessment?
• Are changing hazards and neighbouring activities reviewed?
• Who receives alarms outside business hours, and what happens next?
• Do protective devices have current inspection and test records?
• Are facilities and technology recovery actions coordinated?
• Can the organisation demonstrate that alternate capacity works?
• How is assurance obtained for supplier-controlled sites?
• Have incidents and near misses changed the control design?

Test alert paths and response safely. Review a sample of detector activations, maintenance failures and exercises through closure. Compare listed equipment and dependencies with what is physically present.

Judge evidence quality

A pass is supported when location-specific risks have owners, layered measures match service needs, tests show the measures operate and changes or incidents feed improvement.

A partial result may exist when strong equipment exists but the risk basis is unclear, alert response is untested, supplier responsibilities are incomplete or recovery shares the same hazard exposure.

A fail is likely when material sites have no current threat assessment, known exposures remain untreated without acceptance, protective systems are not maintained or the organisation cannot show how it would respond.

Use the risk score calculator to apply documented likelihood and impact criteria consistently. The tool supports a decision; it does not replace site expertise or authorised risk acceptance.

Review change and emerging exposure

Reassess after a move, refurbishment, new equipment, changed utilities, nearby construction, supplier change, incident or material update in local hazard information. Review whether climate and land-use changes affect assumptions over the intended life of the facility or service.

The official ISO/IEC 27002 overview describes guidance for information-security controls. ISO 31000 provides broader risk-management principles that can support consistent context, assessment, treatment and review; it does not replace ISO 27001 requirements.

Control A.7.5 is strongest when evidence connects local threat knowledge to physical measures, tested response and service recovery. That chain shows the organisation has moved beyond generic facility claims to managed information-security risk.