Key takeaways
- Protect against fire, flood, power cuts and other physical threats.
- Fire, flood, power loss and other physical threats can destroy information and systems.
- Start here: assess environmental risks for each site.
Purpose
Protect against fire, flood, power cuts and other physical threats.
Requirement
Requirement summaryProtection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented.
Why it matters
Fire, flood, power loss and other physical threats can destroy information and systems.
How to implement
- Assess environmental risks for each site.
- Install protections such as fire suppression, water detection and UPS.
- Choose cloud regions and data centres with suitable resilience.
- Test protections and keep maintenance records.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.5. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your assessment of physical risks such as fire, flood and power cuts.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.5 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Maintenance records for fire detection, extinguishers and other protections.
- Records of any incidents, such as leaks, and the response.
Things you should be able to show or explain
- Be able to show how key equipment is protected from these risks.
How much to show: Each in-scope site.
Common mistakes
- Equipment in a flood-prone area.
- Fire equipment overdue for service.
- Equipment rooms below water pipes.
- Relying on cloud without checking provider resilience.
- Tip: Use your landlord's or data centre's evidence where relevant.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.5 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.5?
Be ready to explain how the control works in your organisation and to provide things like: Your assessment of physical risks such as fire, flood and power cuts…