Protecting against physical and environmental threats
Purpose
Prevent or lessen harm from physical and environmental threats such as natural disasters and physical attacks.
How to meet this control
In short: Design protection against fire, flood, and other threats.
- Step 01Run a physical and environmental risk assessment for each site covering fire, flood, storm, earthquake and civil threats, and repeat it periodically
- Step 02Install fire detection and suppression appropriate to the space, such as smoke detection and clean-agent or sprinkler systems sized for the room
- Step 03Fit water and flood detection under raised floors or near rooms holding equipment, and keep response measures ready
- Step 04Protect equipment against electrical surges with surge filters and place critical kit away from known hazards such as plumbing and external walls
- Step 05Take specialist advice for higher-risk sites and factor local topography, flood maps and bushfire risk into siting decisions
- Step 06Maintain and test environmental protection systems on a schedule
Tip: Smoke detection, fire suppression, and sensible siting away from hazards.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Run risk assessments for physical and environmental threats before operating at a site and repeat regularly
- ›Get specialist advice on managing risks like fire, flood, earthquake, explosion and civil unrest
- ›Factor local topography, water bodies and fault lines into site selection and construction
- ›Consider urban threats such as high-profile locations attractive to unrest or crime
- ›Install early fire detection and suitable suppression systems sized to the environment
- ›Fit early flood detection under floors holding media or systems, and keep water pumps available
- ›Protect servers against electrical surges and run random checks for explosives or weapons at sensitive sites
Audit evidence to keep
- - The physical and environmental risk assessment for the site
- - Fire detection and suppression system records and certificates
- - Flood or water-detection installation and test records
- - Maintenance and test logs for environmental protection systems
- - Surge-protection or siting decisions documented for critical equipment
Common mistakes
- - Relying on office trust without logs
- - Not tracking assets used away from the office
- - Disposing equipment without wipe or destruction evidence
Owner, cadence, and proof
Assign one accountable owner for A.7.5. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.