Memory cues
| Control | Cue |
|---|---|
| A.7.5 Protecting Against Physical and Environmental Threats | Protect the site from fire, flood, power, cooling, neighbor, and disaster risks |
| A.7.6 Working in Secure Areas | Control how sensitive work is performed inside secure areas |
| A.7.7 Clear Desk and Clear Screen | Do not leave papers, media, screens, printers, or faxes exposed |
Likely exam traps
- A.7.5 is not just fire safety; it covers physical and environmental threats to infrastructure.
- A.7.5 should link to risk assessment, specialist advice, and business continuity.
- A.7.6 is not the same as A.7.2. A.7.2 controls entry; A.7.6 controls work inside secure areas.
- A.7.6 can include need-to-know, device restrictions, supervision, and dual control where risk requires it.
- A.7.7 is not tidiness; it protects unattended information from unauthorized viewing, loss, photography, and disposal errors.
- A.7.7 includes printers and fax machines where sensitive output can be exposed.
Quick comparison
| Question | A.7.5 | A.7.6 | A.7.7 |
|---|---|---|---|
| Main concern | Hazard damage to infrastructure | Sensitive work inside secure areas | Unattended information exposure |
| Typical evidence | Hazard assessment, inspection, specialist advice | Secure-area procedure, authorization, supervision records | Policy, auto-lock, inspection records |
| Audit method | Site walkthrough and continuity review | Observe/interview secure-area workers | Walk desks, screens, printers, faxes |
| Common failure | BCP ignores site hazards | Locked room but weak work rules | Policy exists but no enforcement |
Practical mentor takeaway
Exam lens
In physical controls, always ask whether the control protects the asset in the real environment. A sign, locked door, CCTV camera, or policy is weak unless behavior, maintenance, and evidence prove it works.
- Iso27001
- Exam
- Physical controls
Note Metadata
Aliases: A.7.5 A.7.6 A.7.7 exam cues
Source: 09-Exam-Preparation/EXAM-022-Environmental-Secure-Areas-and-Clear-Desk.md