All 93 controls · Physical controls
Control 7.5
Protecting against physical and environmental threats
What ISO/IEC 27002:2022 control 7.5 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
The organization is to design and implement protection for its infrastructure against natural disasters and other physical or environmental hazards, whether deliberate or accidental. Purpose: prevent events arising from physical and environmental threats, or lessen their consequences. Guidance: assess the risks from such threats before critical operations start at a site and at regular intervals afterwards, put the necessary safeguards in place and watch for changes in threats. Obtain specialist advice on handling hazards including fire, flooding, earthquakes, explosions, civil disorder, toxic waste or emissions, and other disasters of natural or human origin. The location and construction of premises should account for local topography (elevation, nearby water, tectonic faults) and urban threats (places likely to attract political unrest, crime or terrorism). Based on the risk assessment, consider controls such as: early fire detection that raises alarms or triggers suppression to protect storage media and systems, using the suppressant best suited to the setting (for example gas in enclosed spaces); early flood detection beneath floors of areas holding media or systems, with pumps or similar readily available; protection of servers and client systems against power surges; and random checks of people, vehicles and goods entering sensitive facilities for explosives or weapons. Other information: safes and secure storage protect contents against fire, earthquake, flood or explosion; crime prevention through environmental design can turn features like statues or water features into barriers instead of bollards.
Purpose in the standard’s terms, in our words: Prevents or reduces the consequences of events arising from physical and environmental threats.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Physical and environmental risk assessments performed before critical operations began at each site and repeated periodically
- Specialist advice or reports on fire, flood, seismic, explosion and civil unrest risks
- Site selection records considering elevation, water, fault lines and urban threat profile
- Fire detection and suppression system design, inspection and test records, with the suppressant chosen for the environment
- Under-floor flood detection, pump availability and surge protection records
- Records of random inspections for explosives or weapons at sensitive facilities where applied
Where audits commonly find gaps
- No environmental risk assessment was made before a data room was built
- Water suppression is used where it would destroy equipment and media
- Flood detection is absent beneath raised floors
- Threat changes such as new flood mapping are not monitored
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (11.1.4) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.