A.7.5 Protecting against physical and environmental threats

Control objective

This control protects premises and information processing facilities against natural and man-made threats such as fire, flooding, earthquake, lightning, power failure, explosion, and civil unrest. The organization should identify the threats relevant to each site from its geographic location, surroundings, and history of past incidents, and then design and operate preventive and mitigating facilities and procedures proportionate to the assessed threat level. The aim is to reduce the risk of information loss, equipment damage, and service disruption caused by physical or environmental events, and to establish a basis for limiting impact and recovering quickly when an event does occur.

Key checkpoints

Are physical and environmental threats identified for each site with regard to geographic location and surroundings (rivers, adjacent hazardous facilities, traffic, flooding history, and so on)?
For each identified threat (fire, flooding, earthquake, power failure, lightning, and so on), are preventive and mitigating facilities in place proportionate to the risk level?
Are environmental protection facilities such as fire detection and suppression, water-leak detection, temperature/humidity control, and UPS/emergency power inspected and tested regularly to confirm they operate correctly?
Are critical facility areas such as server rooms and data centers sited or reinforced to avoid locations vulnerable to flooding, fire spread, or external impact (lowest basement level, beneath plumbing, adjacent to outer walls, and so on)?
Are procedures and responsibilities defined for alerting, initial response, notification of authorities, and escalation to responsible staff when a physical or environmental event occurs?
Are threats arising from adjacent premises or external factors (nearby construction, hazardous material storage, leaks from upper floors, and so on) identified and addressed?

Implementation guidance

Survey each site for geographic/environmental characteristics and history of past incidents, list the relevant physical and environmental threats, and set treatment priorities based on the risk assessment.
Have qualified specialists design and inspect fire detection, suppression, compartmentation, and fire-resistant provisions for facility risks, life safety, evacuation, and applicable rules. Test gas-based and other suppression systems with occupant protection, alarms, and safe discharge conditions in view, alongside equipment suitability.
Against flooding and leaks, install leak-detection sensors, drainage, and water barriers, and review siting so critical facilities are not placed in the lowest level, beneath plumbing, or against outer walls.
Against power failure or anomalies, provide UPS and emergency generation, periodically check and test capacity, runtime, and fuel reserves, and apply surge protection and grounding.
Operate HVAC/precision cooling for temperature and humidity control with alarms on threshold breaches, and in seismic areas apply earthquake reinforcement such as securing racks and equipment.
Link detection and alarm facilities to continuous monitoring and notification so events are recognized early, document initial-response and authority-notification procedures, and make sure the relevant staff are familiar with them.
Periodically reassess threats from external factors such as adjacent premises, nearby construction, and handling of hazardous materials, and update mitigations, drawing on advice from specialists or authorities where needed.

Related controls and attributes

Evidence

Physical and environmental threat identification and risk assessment results per site
Inventory and layout of protection facilities such as fire detection/suppression, leak detection, precision cooling, and UPS/emergency power
Plans and records of periodic inspection and operational testing of protection facilities
Environmental monitoring (temperature/humidity, leak, power) records and alarm history
Physical/environmental event response procedures and documentation of the authority-notification and escalation scheme
Records of threat reviews for adjacent premises and external factors, and of advice from specialists or authorities

Nonconformity examples

The server room sits in the building's lowest level, beneath plumbing, or against an outer wall, exposing it to flooding/leak risk, yet no mitigating measures are in place.
Fire detection/suppression, leak detection, and precision cooling exist but are not inspected or operationally tested, so it cannot be confirmed they actually work.
No physical or environmental threat identification has been performed with regard to geographic location or surroundings (flooding history, adjacent hazardous facilities, and so on).
UPS/emergency generation capacity or runtime does not meet the actual load or recovery objectives, or fuel/battery condition is not checked.
No alarm or notification scheme exists for temperature/humidity, leak, or power anomalies, so events are not recognized early even when they occur.
Threats from adjacent premises or external factors such as leaks from upper floors or nearby construction are omitted from identification and treatment.