A.7.5Protecting against physical and environmental threats
Protect facilities against physical and environmental threats such as fire, flood and power problems, so a single event cannot easily take you offline.
Mapping at a glance
A.7.5Protecting against physical and environmental threatsISO/IEC 27001:2022
What an auditor, or Sekit's evidence engine, asks for.
Facility resilience and media controls
The protections against power or climate failures affecting critical systems, and the control of cabling and facility security zones.
From the Sekit evidence catalog
In practice
For a small office, this control is less about buying equipment and more about naming the physical risks worth planning for: fire in a server room, flood risk from a burst pipe upstairs, or a break-in that damages hardware, not only a power outage. Auditors expect a short environmental risk review covering the building itself, fire suppression or smoke detection appropriate to the space, and evidence the review gets revisited when the office moves or a risk changes, not filed once and forgotten. Power and cooling resilience live on this page too, but a review that only covers UPS runtime misses the wider threats this control names.
Common gaps
A UPS unit was purchased for the server rack but has never been tested under load, so its actual runtime during a real outage is unknown.
No written acknowledgment identifies which equipment depends on power and cooling, so a new hire cannot tell what needs protecting during an outage.
No fire suppression or flood risk review exists for the office beyond the general building lease, so a burst pipe or small fire has no documented response plan.
Questions your auditor will ask
What physical and environmental threats beyond power outages has the company assessed?
A short environmental risk review covers fire, flood and building-specific hazards for the office, not only power and cooling dependencies, and is revisited when the office or its risks change.
How do you know the UPS or generator will work during a real outage?
UPS units, generators and cooling are tested and maintained on a schedule, captured in the facility resilience and media controls evidence.
What happens if an environmental sensor detects a cooling or power problem?
Environmental sensors and alerts are sized to reach someone who can act, not only log an event nobody reviews.
Where regulation demands it
NIS2 art. 13.1 requires protection of supporting utilities such as power and cooling for network and information systems.
ENS mp.if.4 requires energía eléctrica, protection of the electrical supply that critical equipment depends on.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.