Protecting Against Physical and Environmental Threats - ISO 27001 Annex A Control
ISO 27001 Annex A 7.5
Information has to survive the things that can damage the building it sits in.
ISO 27001 Annex A 7.5 - Protecting Against Physical and Environmental Threats
The control widens the lens beyond intruders. Fire, flood, severe weather, vandalism, accidental damage, terrorism, civil disruption - all can damage the equipment and information that sits inside the perimeter. The control asks the organisation to think about these threats specifically and put protections in place that match the actual risk profile of the location.
Some protections are universal. Smoke detection and fire suppression in any space holding equipment. Power protection through UPS or generators. Reasonable resilience against water damage from leaks or flooding. Backup arrangements that hold copies somewhere physically separate from the primary site.
Other protections are location-specific. A site in a flood zone needs different controls to a site on high ground. A city centre office faces different civil-disruption risks to a rural site. The risk assessment should drive the control selection rather than a generic checklist applied without thought to local conditions.
The most common gap in this control is the gap between the planned protection and the actual environment. Server rooms with no smoke detectors. Power-protected systems whose UPS has not been tested. Fire suppression systems whose service has lapsed. The audit will sample the actual state of the protections rather than the documented intent, and gaps tend to surface quickly.
Practical Compliance Guidance
Environmental threat protection is described in the IMS1 Manual in Section 8.3 IT Equipment and Physical Security. The F-Q26 Premises Monthly Checklist can be used to assess for physical and environmental threats.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| F-IMS21 Business Continuity Register | The business continuity register listing scenarios and arrangements. Use to record the environmental threats considered and the protection arrangements in place for each. |
| F-Q26 Premises Monthly Checklist | This professional checklist helps businesses demonstrate that regular safety inspections, equipment checks, and premises compliance controls are being carried out consistently and documented correctly. |
Note - all the above files can be downloaded with an alphaZ subscription.
