ISO 27001:2022 · Physical controls
ISO 27001:2022 7.5: Protecting against physical and environmental threats
ISO 27001:2022 7.5 covers Protecting against physical and environmental threats. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.5, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is No environmental risk assessment was made before a data room was built.
The organization is to design and implement protection for its infrastructure against natural disasters and other physical or environmental hazards, whether deliberate or accidental. Purpose (stated in ISO/IEC 27002:2022): prevents or reduces the consequences of events arising from physical and environmental threats. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.5.
What evidence supports 7.5?
- Annex A physical controlStatement of Applicability entry for control A.7.5, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlPhysical and environmental risk assessments performed before critical operations began at each site and repeated periodically
- Annex A physical controlSpecialist advice or reports on fire, flood, seismic, explosion and civil unrest risks
- Annex A physical controlSite selection records considering elevation, water, fault lines and urban threat profile
- Annex A physical controlFire detection and suppression system design, inspection and test records, with the suppressant chosen for the environment
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.5, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- No environmental risk assessment was made before a data room was built
- Water suppression is used where it would destroy equipment and media
- Flood detection is absent beneath raised floors
- Threat changes such as new flood mapping are not monitored
How it maps to SOC 2
- A1.2 high Protecting against physical and environmental threats is the environmental limb.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.