ISO 27001 A.7.5 - Protecting Against Physical and Environmental Threats

Requirement

“Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.”

Plain-language meaning

The organization should protect sites, buildings, rooms, and infrastructure from hazards such as fire, flood, explosion, chemical leaks, civil unrest, utility failure, and threats from neighboring premises.

This is not only a facilities topic. If a physical or environmental event can damage information assets, interrupt ICT services, destroy records, or make a secure area unusable, it belongs in the ISMS risk picture.

Why this matters

Physical and environmental threats can take down confidentiality, integrity, and availability at the same time. A server room in a flood-prone basement, paper records stored near ignition sources, or cooling failure after a power outage can create an information security incident even when logical security is strong.

Implementation guidance

1. Identify realistic hazards

Assess threats such as:

• fire and smoke;
• flood, water leaks, drainage failure, or pipes above critical equipment;
• explosion or hazardous materials;
• chemical leaks from nearby sites;
• civil unrest, protest, or targeted hostility;
• power failure and secondary cooling failure;
• extreme weather;
• structural weakness;
• neighboring businesses that increase hazard or hostile-attention risk;
• storage practices that increase fire load or block safety equipment.

2. Consider site and neighbor context

The organization should consider both its own premises and nearby accommodation.

Examples:

3. Use specialist advice where needed

Specialists may be needed for fire protection, building safety, environmental controls, electrical resilience, flood protection, chemical hazard, and security engineering.

Keep records of advice, decisions, and rejected options. Link the decision to Risk Assessment, Control Attributes and Risk Treatment Effects, and Statement of Applicability where applicable.

4. Align with business continuity

Fallback arrangements and backups should support A.5.29 Information Security During Disruption and A.5.30 ICT Readiness for Business Continuity.

Check whether physical protection aligns with:

• recovery time objectives;
• backup location and restoration assumptions;
• alternate worksite arrangements;
• emergency response responsibilities;
• critical supplier and utility dependencies;
• server room cooling and power resilience.

5. Train relevant personnel

Staff involved in emergency response, facilities operations, security, and ICT recovery should know what to do when a hazard materializes.

Training records should show who was trained, on what procedure, and when.

Audit guidance

Auditors should verify:

• documented physical/environmental threat assessment;
• site and neighboring-premises hazard analysis;
• specialist advice or inspection records;
• implemented fire, flood, environmental, and emergency controls;
• linkage to Risk Assessment, Control Attributes and Risk Treatment Effects, and continuity plans;
• backup and fallback arrangements;
• training records for relevant personnel;
• evidence that controls still work and have not degraded over time.

Walkthrough testing matters. Look for practical weaknesses such as blocked fire extinguishers, fire doors propped open, paper stored in corridors, server rooms below water pipes, basement equipment, or poor housekeeping around critical infrastructure.

Evidence examples

Strong evidence

• Hazard assessment includes site, building, room, and neighbor risks.
• Controls are documented, implemented, and maintained.
• Specialist advice exists for material hazards.
• Continuity plans consider secondary effects such as cooling failure after power loss.
• Walkthroughs identify and correct practical weaknesses.
• Training records exist for emergency and response roles.

Weak evidence

• Generic statement that the building is safe.
• Fire extinguishers exist but no site hazard assessment is available.
• BCP exists but ignores physical site failure.
• Specialist advice is missing where hazards are material.
• Controls have degraded over time, such as blocked extinguishers or propped fire doors.
• Server room location risks are not assessed.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.1 Physical Security Perimeters
• A.7.3 Securing Offices Rooms and Facilities
• A.7.4 Physical Security Monitoring
• A.5.29 Information Security During Disruption
• A.5.30 ICT Readiness for Business Continuity
• Risk Assessment
• Statement of Applicability
• Control Attributes and Risk Treatment Effects
• Physical and Environmental Threat Assessment
• Environmental Protection Inspection Checklist
• A.7.5 Audit Evidence Pack
• A.7.5 Audit Checklist

KB-ready summary

• Assess hazards from the site, building, rooms, utilities, environment, and neighbors.
• Use specialist advice where the risk requires competence beyond the ISMS team.
• Link controls to risk assessment, continuity plans, backup assumptions, and emergency response.
• Audit by walking the site, checking records, and testing whether controls still work in practice.

Templates and checklists

• Physical and Environmental Threat Assessment
• Environmental Protection Inspection Checklist
• A.7.5 Audit Checklist