ISO 27001 Control 7.5: Protecting Against Physical and Environmental Threats

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.5, protecting against physical and environmental threats, requires protection against events such as fire, flood, power loss and other disasters. For a cloud-first small business that largely means choosing resilient providers and making sure no single event can take out both a system and its backup.

Fire, flood, power cuts, extreme heat, a burst pipe in the flat above. Control 7.5 asks you to think about the physical and environmental threats to your information and the systems that hold it, and to protect against them.

For a small, cloud-first business, the biggest of those threats now sit with the cloud provider, whose data centres are built to withstand them. What is left with you is usually modest: the office, the kit in it, and the laptops at home. But “modest” is not “nothing”, and the risk assessment should say so.

This page covers what the control asks for and how to apply it proportionately.

What control 7.5 actually asks for

The control requires protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure, to be designed and implemented. In practice:

• Identify the threats for each location: fire, flood, extreme temperature, power, vandalism, accidental damage.
• Assess them as part of your risk assessment.
• Protect against the significant ones, through siting, equipment and procedures.
• Make sure you can recover, which for most small businesses means backups held somewhere the same event cannot reach.

In the 2013 edition this was control A.11.1.4.

Where the threats really are

If your systems are in AWS, Azure or Google Cloud, the data centres are engineered against fire, flood and power loss far beyond anything a small business could do, and their assurance reports say so. Your exposure is mostly elsewhere:

• The office, if you have one: fire, water damage, break-ins, a failed air conditioning unit in the comms cupboard.
• Any equipment left on-site, such as a legacy server or network kit.
• Laptops, which face spilt coffee, theft from cars and the occasional flood far more often than data centres do.
• Single-region cloud hosting, where a regional outage at the provider is your outage too.

Check whether your office is in a flood risk area using the government’s flood checker, and make sure the building’s fire safety responsibilities are understood, especially in shared buildings.

Proportionate protection

• Keep any on-site equipment off the floor and away from water pipes and windows.
• Make sure comms cupboards are ventilated, so doors do not end up wedged open.
• Use backups that are geographically separate from the thing they protect: another cloud region, or another provider.
• Encrypt laptops, so physical loss is an inconvenience rather than a breach.
• Know what the building provides: fire detection, sprinklers, alarms.

What auditors will look for

I ask what would happen to your systems if the building, or a cloud region, were unavailable.

1. The risk assessment. Are physical and environmental threats considered for each location?
2. On-site equipment. Is it sited sensibly and protected?
3. Backups. Could a single event destroy both the system and its backup?
4. Inherited protection. What the cloud provider and building provide, and how you know.

Common issues

• Environmental threats missing from the risk assessment entirely.
• Network equipment on the floor under a desk or beside a water pipe.
• Backups stored in the same place, or same cloud region, as the systems they protect.
• Overheating comms cupboards with doors propped open.
• No idea whether the office is in a flood risk area.

The self-check

Think about your hottest summer day and your worst storm.

• Is your office in a flood risk area?
• Where is your on-site equipment, and what is above it?
• Would a fire in the office destroy your only backup?
• If your cloud region went down for a day, what would you do?
• Does your risk assessment cover any of this?

Air conditioning, not floods

Across my career, the environmental threat that has caused the most trouble with on-premises equipment has not been flood or fire. It has been air conditioning. Server rooms overheat, and the unit that cools them is often the oldest and least loved piece of equipment in the building.

Earlier in my career, working at a mortgage company, I was responsible for a very elderly air-conditioning unit in a server room. It struggled constantly. Replacing it was discussed for about a year, but management kept stalling because an office move was likely, and nobody wanted to spend money on a building they might leave. In the end the move solved the problem, but for a year the risk sat there. What I learned was the value of a really good, fast-response maintenance contact. If you still run anything on site, know who you will call when the cooling fails, and how quickly they will come.

For cloud-first businesses most of this is inherited from the provider. The point that remains is to make sure no single event, in one building or one cloud region, can take out both a system and its backup.

One question deserves more attention than it gets. Almost every client I work with assumes their backups sit somewhere separate from the live system: a different region, a different provider, or at least a different account. Very few have checked. Honestly, it is not something I have routinely dug into in audits, and I think it should be. If your production system and its backups share a cloud region, one regional outage can take out both. Ask your provider or your IT support where the backups physically live, and write the answer down.

How control 7.5 links to other clauses and controls

• Control 7.8, Equipment siting and protection. Where equipment goes.
• Control 7.11, Supporting utilities. Power and cooling.
• Control 8.13, Information backup. Backups held where the same event cannot reach.
• Control 5.30, ICT readiness for business continuity. Recovering when something does happen.
• Clause 6.1.2, Information security risk assessment. Where these threats are assessed.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Check for flooding. GOV.UK service for checking flood risk and warnings.
• Fire safety in the workplace. GOV.UK guidance on who is responsible for fire safety.
• Cloud security principles: asset protection and resilience. NCSC guidance on what to expect from cloud providers’ data centres.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call