ISO 27001 Annex A 7.5 Protecting Against Physical and Environmental Threats is an ISO 27001 control that requires an organisation to protect against physical and environmental threats.
In this guide you will learn how to implement ISO 27001 Annex A 7.5 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
Purpose & Definition
ISO 27001 Annex A 7.5 is a preventive control that ensures you prevent or reduce the consequences of events originating from physical and environmental threats.
ISO 27001 defines ISO 27001 Annex A 7.5 as:
Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure should be designed and implemented.
ISO 27001:2022 Annex A 7.5 Protecting Against Physical and Environmental Threats
ISO 27001 Annex A 7.5 Training Video
In this free training video you will learn How to implement ISO 27001 Protecting Against Physical and Environmental Threats (Annex A 7.5).
Implementation Guide
General Guidance
You are going to have to
- conduct a risk assessment
- consult a professional for specialist advice where required – for example fire, flood, theft, civil unrest, earthquake, explosions
- install and configure systems to detect fire, flood, electrical surges explosive and weapons
- implement physical security controls based on risk and business need
The implementation of securing offices, rooms and facilities is in the context of the physical security perimeter where you can find guidance in the Ultimate guide to ISO 27001 Annex A 7.1 Physical Security Perimeter.
Health and Safety
Your number one priority is to meet the requirements of law and regulation. Be sure to engage with a legal professional to understand what you can and cannot do and to check that you are not breaking any laws. The most significant laws are those around health and safety as the protection of human life and wellbeing is always our number priority. There are common things that should be considered such as entry point doors that fail open. Whilst we want to protect buildings and information our absolute priority is to protect people.
Protection requirements
Start by understanding your risk and doing a risk assessment. For guidance on how, read The Complete Guide to ISO 27001 Risk Assessment. This is going to be based on the needs of the business and the risks that you are managing. As a starting point there are basics such as protection from fire and flood. It maybe that the physical environment brings with it other threats such as electrical surges, local civil unrest, explosives, tectonic fault lines. Do what is right for you. Consider the environment around the location and the threats that may be posed and be sensible in addressing them.
How to implement ISO 27001 Annex A 7.5
Implementing ISO 27001 Annex A 7.5 requires a multi-layered approach to physical security, ensuring that information processing facilities are resilient against natural disasters, environmental accidents, and malicious human activity.
1. Conduct a Physical and Environmental Risk Assessment
Perform a site-specific survey to identify local hazards such as flood plains, seismic activity zones, or proximity to high-risk industrial facilities.
- Identify critical assets and their vulnerability to fire, water, and extreme temperature fluctuations.
- Document external threats, including potential for vandalism or proximity to shared utility hubs.
- Establish a risk treatment plan that prioritises controls based on the geographic and structural profile of the facility.
2. Provision Automated Fire Detection and Suppression Systems
Deploy industrial-grade fire safety technology to ensure the rapid detection and neutralisation of thermal threats without damaging electronic hardware.
- Install Very Early Smoke Detection Apparatus (VESDA) for high-sensitivity monitoring in server rooms.
- Provision non-water-based fire suppression systems, such as FM-200 or Novec 1230 gas, to prevent electrical short circuits.
- Formalise a monthly inspection routine for all portable extinguishers and emergency exit routes.
3. Implement Water Leak Detection and Flood Mitigation
Establish physical barriers and sensors to protect data processing equipment from plumbing failures or external flooding events.
- Install moisture detection cables beneath raised floors in all critical server environments.
- Position server racks on plinths to provide a minimum clearance of 150mm from the floor level.
- Ensure that IT equipment is not sited directly beneath water pipes or air conditioning drainage units.
4. Configure Environmental Monitoring and HVAC Redundancy
Apply technical monitoring to maintain optimal temperature and humidity levels, preventing hardware degradation or sudden thermal shutdown.
- Provision N+1 redundancy for Heating, Ventilation, and Air Conditioning (HVAC) systems to ensure climate stability during maintenance.
- Link temperature and humidity sensors to a centralised alerting system with real-time notifications for the IT Operations team.
- Maintain automated logging of environmental metrics to provide evidence for ISMS compliance audits.
5. Formalise Protective Siting and Structural Hardening
Review the physical placement of equipment to reduce the profile of sensitive assets against malicious observation or impact.
- Locate critical processing facilities away from ground-floor windows and high-traffic public access points.
- Apply security film to windows and install bollards to protect against vehicle-borne threats or impact.
- Ensure that all utility entry points (power and telecommunications) are buried or enclosed in armoured conduits.
6. Establish an Environmental Maintenance Audit Trail
Document all service activities to verify that protective controls are functioning correctly and remain reliable under duress.
- Formalise a Register of Entrants (ROE) for third-party maintenance staff performing utility repairs.
- Archive maintenance certificates for UPS systems, generators, and suppression systems for at least 12 months.
- Review incident logs monthly to identify recurring environmental anomalies that require corrective action.
Template
To communicate to people what you do and what is expected you are going to write, sign off, implement and communicate your topic specific Physical and Environmental Security Policy.
How to pass the audit
To pass the audit of ISO 27001 Annex A 7.5 you are going to
- Define your physical protection requirements
- Consult with a legal professional to ensure you are meeting legal and regulatory requirements
- Consult with appropriate professionals who specialise in the identified protection requirements
- Implement your physical threat protection
- Write, sign off, implement and communicate your topic specific Physical and Environmental Security Policy
- Write, sign off, implement and communicate your perimeter incident response procedures
- Implement a process of internal audit that checks that the appropriate controls are in place and effective and where they are not follow the continual improvement process to address the risks
What the auditor will check
The audit is going to check a number of areas. Lets go through them
1. That you have considered physical and environmental threats
The audit will do some research and identify any obvious physical and environmental threats and that you have addressed them. If you are in a flood plane, have you considered and implemented protection against flooding. If you are in an area to susceptible to civil unrest do your controls address this. Are the basics such as fire protection covered and are they appropriate. A common one to check here is that fire extinguishers are legal and maintained and evidenced as being maintained.
2. The you have implemented controls
They have been doing this a long time and done many audits so they know what to look for. They will test the controls and see what happens where they can. They will want to see evidence that the controls have been reviewed and tested and are working as intended.
3. Documentation
They are going to look at audit trails and all your documentation. They will look at appropriate maintenance, reviews, logs of monitors and reports, incidents and how you managed them.
Top 3 mistakes and how to avoid them
The top 3 mistakes people make for ISO 27001 Annex A 7.5 are
1. Your fire extinguishers are not up to date
This one feels a bit random but as they walk around they will check fire extinguishers and look for evidence that they are operational and maintained. An example would be a fire extinguisher that works on pressure and the pressure gauge is at zero or in the red. Also that there is no evidence of them being maintained.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Have control reviews taken place? Who gets informed about about the alarms and notification and do they still work here?
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 7.5 FAQ
Under ISO 27001, these threats are external factors that can damage hardware, disrupt utilities, or compromise the safety of a secure facility.
Natural Disasters: Flooding, earthquakes, lightning strikes, and wind damage.
Environmental Hazards: Fire, smoke, water leaks (plumbing), and extreme temperatures.
Malicious Threats: Terrorist attacks, physical vandalism, and explosive devices.
Utility Failures: Extended power outages or telecommunications line cuts.
Yes, fire detection and suppression systems are essential controls to mitigate the risk of data destruction and ensure the continued availability of IT assets.
Automatic smoke and heat detectors must be installed in all secure areas.
Non-water-based suppression (e.g., gas or FM-200) is preferred for server rooms.
Portable fire extinguishers must be accessible and regularly maintained.
Fire escape routes must be clearly marked and kept unobstructed.
Protecting against water damage involves a combination of site selection, structural engineering, and automated detection systems.
Avoid placing server rooms in basements or directly under water pipes.
Install moisture and leak detection sensors beneath raised floors.
Ensure critical hardware is raised on plinths or racks to avoid low-level flooding.
Regularly inspect the building’s exterior for structural integrity and drainage efficiency.
No, it is generally recommended to avoid ground-floor locations for server rooms due to higher risks of physical intrusion, vehicle impact, and surface flooding.
Upper-floor locations provide better protection against opportunistic physical theft.
Internal rooms without windows are preferred to reduce the risk of visual eavesdropping.
Ground-floor windows in secure areas must be reinforced with security film or bars.
Related ISO 27001 Controls
ISO 27001 Annex A 7.5 Attribute Table
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality Integrity Availability | Protect | Physical_security | Protection |
Stuart Barker
Stuart Barker is qualified ISO 27001 Lead Auditor and a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
Now he is founder and Lead ISO 27001 Consultant at High Table, the worlds number 1 dedicated ISO 27001 Consultancy.
