ISO 27001 A.7.5: Protecting Against Physical and Environmental Threats

Quick Reference (60 Seconds)

The Bottom Line: A.7.5 starts with a site risk assessment, not a shopping list. Know what nature and people could do to each site (flood, fire, earthquake, unrest, explosion), get specialist advice, and fit safeguards in proportion. Power, cooling and other utilities belong to A.7.11; recovering from a disaster belongs to continuity (A.5.29, A.5.30) and backup (A.8.13).

What the Control Asks For

In short

Annex A 7.5 asks organizations to design and put safeguards in place against physical and environmental threats, from fire and flood to natural disasters and other accidental or deliberate harm to facilities.

Do you need this control?

A.7.5 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Include it if you own or operate premises or equipment in scope. If everything runs in the cloud and your offices hold nothing critical, you may justify a narrow scope and rely on your providers' assurance (A.5.23).

What ISO 27002:2022 Adds

ISO 27002 7.5 (paraphrased):

• Assess first. Assess the potential consequences of physical and environmental threats before critical operations begin at a site, and at regular intervals. Implement the safeguards needed and monitor changes in the threats.
• Take specialist advice on threats such as fire, flood, earthquake, explosion, civil unrest, toxic waste, environmental emissions and other natural or human-made disasters.
• Site location and construction should take account of:
  • (a) local topography: elevation, nearby water bodies and tectonic fault lines
  • (b) urban threats: locations that attract political unrest, crime or terrorism
• Controls to consider: based on the assessment:
  • (a) fire: early detection that raises alarms or triggers suppression, using the suppressant best suited to the space (for example gas in confined spaces)
  • (b) flooding: early detection under the floors of areas with media or processing systems, with pumps or equivalent ready
  • (c) electrical surges: protection for server and client systems
  • (d) explosives and weapons: random inspections of people, vehicles and goods entering sensitive processing facilities
• Other information: safes and secure storage protect information from fire, earthquake, flood or explosion, and crime prevention through environmental design (CPTED) can reduce urban threats (for example planters or features that double as vehicle barriers).

What Belongs to Sibling Controls

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): protection against physical and environmental threats is designed and implemented.
• Should (27002 guidance): the assessment, specialist advice and example controls above, in proportion to your sites.

Common Misinterpretations

Why It Matters

The Business Risk Narrative

A fire, flood or collapse can destroy equipment, media and paper records in minutes, and with them availability, integrity and sometimes confidentiality (a flooded office can mean records left exposed). These events are rarer than cyber attacks but far harder to recover from without preparation.

Indian conditions make several threats real for ordinary offices:

• Monsoon flooding: Mumbai (2005), Chennai (2015) and Bengaluru (2022) all saw offices and IT operations disrupted by urban flooding. Basement server rooms and ground-floor stores are most exposed.
• Fire: dense commercial buildings, overloaded wiring and diesel storage make fire a leading physical risk.
• Earthquake: large parts of India, including Delhi NCR, sit in higher seismic zones.
• Heat and lightning: summer temperatures stress cooling (A.7.11), and many regions see frequent lightning.
• Civil unrest: protests and bandhs can close sites or put staff at risk.

Under the DPDP Act 2023, a fiduciary must take reasonable security safeguards (s.8(5)); losing or exposing personal data because a predictable environmental risk was ignored would be hard to defend, and the penalty for failing to take safeguards can reach ₹250 crore.

Indian Regulatory Context

Scope and Applicability

What the Control Covers

• Threat assessment for each site, before critical operations begin and periodically
• Siting and construction choices (topography, flood risk, fault lines, urban threats)
• Fire detection and suppression for areas holding information and processing systems
• Flood and water-leak detection and response
• Surge and lightning protection
• Random inspection for explosives and weapons at sensitive facilities, where the risk warrants it
• Safes and secure storage for critical media and records

What It Does NOT Cover

Power, cooling and other utilities (A.7.11), equipment placement within rooms (A.7.8), continuity and DR plans (A.5.29, A.5.30), backups and redundancy (A.8.13, A.8.14), and general workplace safety beyond protecting information assets.

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Detailed Implementation Guidance

Step 1: Assess Each Site

Do this before critical operations start at a new site, at least annually, and after any major change (new floor, flood, nearby construction, changed political situation). Get specialist input (fire consultant, structural engineer, electrical contractor) where you lack the expertise.

Record each threat with likelihood, consequence, existing safeguards and planned actions in the risk register, with a named risk owner.

Step 2: Fire Detection and Suppression

• Detection: automatic smoke detection in every area holding processing equipment or records; consider aspirating (very early) detection for server rooms and data halls. Link detectors to alarms that someone responds to (A.7.4).
• Suppression: choose the agent for the space, with a fire consultant and within the NBC and your fire NOC:

• Room integrity: gas systems only work if the room holds the gas. Seal penetrations, fit door closers and test integrity when the system is installed and after building works.
• Safety: gas discharges need pre-discharge alarms, abort and hold switches, and evacuation training. Inert gases lower oxygen levels by design, so follow the system designer's safety limits.
• Service: inspect and service suppression and detection systems at the intervals the manufacturer and your fire NOC require, and keep the records.

Step 3: Flood and Water

• Do not put critical rooms in basements or below water tanks, toilets or kitchens. If you have no choice, raise equipment, add drip trays and route pipes away.
• Fit leak detection under raised floors and near AC units and pipes, alarmed to someone who responds.
• Keep pumps or wet vacuums available, and know where the water shut-off valves are.
• Before the monsoon, check drainage, roof and terrace outlets, and the seals around the server room. In flood-prone areas, keep sandbags or flood barriers for doorways.

Step 4: Surges and Lightning

• Have an electrical contractor assess the building under IS/IEC 62305 and fit the protection level it calls for.
• Install surge protective devices in stages (incoming supply, distribution boards, and at equipment) and protect data and telecom lines entering the building.
• Test earthing periodically and after building works. UPS, generators and power quality belong to A.7.11.

Step 5: Earthquake

• Know the seismic zone. In higher zones, anchor racks and tall cabinets, use seismic-rated racks, brace overhead cable trays, and fit flexible connections on pipes.
• Store heavy items low; secure shelving in records rooms.
• Plan for loss of the site: offsite backups and recovery capability (A.8.13, A.8.14, A.5.30).

Step 6: Urban Threats, Explosives and Weapons

• For sites in sensitive locations, assess exposure to protests, crime and attack, and plan for closures (A.5.29).
• At sensitive facilities, use random inspection of people, vehicles and goods: bag screening, metal detectors, under-vehicle checks. Give notice, follow dignity safeguards (same-gender frisking), and use PSARA-licensed guards.
• Use CPTED: clear sightlines, lighting, landscaping and features that double as vehicle barriers.

Step 7: Safes and Secure Storage

• Keep critical media and records that must stay on site in fire-rated safes. Paper-rated safes do not protect magnetic media; for media choose a data-rated safe (for example UL 72 Class 125 or EN 1047-1).
• Keep at least one copy of critical backups offsite or in the cloud (A.8.13).

Step 8: Test, Drill and Reassess

• Test detectors, leak sensors and suppression alarms on schedule; run evacuation drills.
• Reassess each site annually and after any incident or change.
• Feed lessons into the risk register and the continuity plans.

Environmental Protection Policy (Template)

Environmental Protection Policy: [Organisation] (A.7.5)

1. Site assessment. A physical and environmental threat assessment shall be completed
   before critical operations start at any site, at least annually, and after major
   change. Specialist advice shall be obtained where needed.

2. Siting. Critical rooms shall not be located where flooding, leaks or other hazards
   are likely, unless the assessment shows the risk is treated.

3. Fire. Areas holding information processing equipment and critical records shall
   have automatic fire detection and suppression suited to the space, designed and
   serviced in line with the National Building Code 2016 Part 4 and the fire NOC.

4. Water. Leak detection shall be fitted where water could reach critical equipment,
   and pumps or equivalent shall be available.

5. Surges and lightning. Lightning and surge protection shall be fitted as the
   IS/IEC 62305 assessment requires.

6. Earthquake. In higher seismic zones, racks and cabinets shall be anchored and
   overhead services braced.

7. Sensitive facilities. Random inspection for explosives and weapons shall be used at
   [facilities], with notice and dignity safeguards.

8. Storage. Critical media and records kept on site shall be stored in fire-rated,
   data-rated safes where appropriate; copies of critical backups shall be held offsite.

9. Testing and review. Detection, suppression and leak systems shall be tested and
   serviced on schedule, and this policy and the site assessments reviewed annually.

Owner: [Facilities Lead]   Approved by: [Top management]   Review: annual

Risk Assessment and Treatment

Audit and Compliance Checklist

Metrics and KPIs

Common Pitfalls

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: SaaS Company, Basement Server Room (Bengaluru)

Situation. A 55-person SaaS company kept its on-site servers (build servers and a backup appliance) in a basement room below the building's water tank. In a heavy monsoon week, water seeped in under the door overnight. There were no leak sensors, the only backup copy sat on the appliance in the same room, and the room had one CO2 extinguisher.

What changed.

1. A site threat assessment was written for each office, with input from the landlord's facilities engineer.
2. Equipment moved to a first-floor interior room; the basement now holds nothing critical.
3. Leak sensors near the AC unit, smoke detection linked to the building alarm, and surge protection were fitted.
4. Backups were copied to cloud storage in a separate region; restore tests began.
5. A pre-monsoon checklist (drains, seals, terrace outlets) was added to the facilities calendar.

Lesson. The cheapest control was siting: moving the room removed most of the flood risk.

Illustrative Scenario 2: Financial Services Data Centre (Mumbai)

Situation. An internal review of a regional data centre found an old HFC-227ea system with an overdue service, a failed room integrity test after cabling works, no leak detection under the raised floor, and racks that were not anchored. The site had never had a written threat assessment covering monsoon flooding and the coastal cyclone risk.

What changed.

1. A fire consultant and a structural engineer assessed the site; the assessment now goes to the risk owner each year.
2. Penetrations were sealed and the integrity test repeated; servicing was brought up to date, and the replacement plan considers inert gas because of the HFC phase-down.
3. Aspirating smoke detection and cable leak detection under the raised floor were added, both alarmed to the 24/7 operations desk.
4. Racks were anchored and overhead trays braced.
5. Flood barriers and pumps were staged before each monsoon, and the DR site test now includes a "site lost to flooding" scenario.

Lesson. Systems that exist on paper fail when nobody tests them after building works.

Maturity Model

Figure · Tiers

Maturity levels for protecting against physical and environmental threats

Target L3 for certification.

Key Takeaways

• Start with a site threat assessment before operations begin, then review it regularly.
• Get specialist advice for fire, structure and electrical protection.
• Think about topography and urban threats when you choose and fit out sites.
• Match fire suppression to the space and the code; plan for the HFC phase-down and the end of Novec.
• Detect water early, keep pumps ready, and take the monsoon seriously.
• Leave utilities to A.7.11 and recovery to A.5.29, A.5.30 and A.8.13.

Multi-Framework Mapping

FAQ

Is A.7.5 mandatory?

No Annex A control is mandatory in itself. Most organisations with premises select it through risk treatment (clause 6.1.3) and record it in the Statement of Applicability. A cloud-only organisation may justify a narrow scope and rely on its providers' assurance.

Are water sprinklers banned in server rooms?

No. Building codes often require sprinklers, and many data centres use pre-action systems that only fill with water once a fire is confirmed, sometimes combined with gas or water mist. Agree the design with a fire consultant and your fire authority.

Should we still install FM-200 or Novec?

For new systems, weigh the options. FM-200 is an HFC being phased down under the Kigali Amendment, and 3M stopped making Novec at the end of 2025 (other makers supply FK-5-1-12). Inert gas systems avoid both issues but need more space.

Does RBI prescribe a particular suppression system?

Not as far as we are aware. Regulated entities must meet RBI, SEBI or IRDAI expectations for resilience and business continuity, but the choice of suppression is a design decision for your fire consultant within the building code.

What temperature and humidity should a server room run at?

That is A.7.11 territory. As a guide, ASHRAE's recommended envelope for IT equipment is 18–27 °C with a dew point between −9 °C and 15 °C and relative humidity up to 60% (70% where gaseous pollution is low). Follow your equipment makers' specifications.

How often should we reassess the site?

Before critical operations start, at least annually, and after any significant change or incident (27002 asks for regular intervals and monitoring of threat changes).

We rent a floor in a multi-tenant building. What can we do?

Get the building's fire NOC and fire audit, ask the landlord about flood history and drainage, put your critical equipment in the safest room you control, add leak and smoke detection, and rely on offsite or cloud copies for recovery.

What does an auditor look for?

A site threat assessment, evidence of specialist advice, detection and suppression suited to the space with service and test records, leak detection, and a sensible link to continuity and backups.

References and Further Reading

Standards

• ISO/IEC 27001:2022 Annex A 7.5; ISO/IEC 27002:2022 7.5.
• ISO 14520: gaseous fire-extinguishing systems.
• IS/IEC 62305: lightning protection; IS 1893 (Part 1): earthquake-resistant design (current edition).
• ASHRAE TC 9.9 thermal guidelines for data processing environments.

Indian law and guidance

• National Building Code of India 2016: Part 4; state fire service rules and NOCs.
• CEA (Measures relating to Safety and Electric Supply) Regulations 2023.
• E-Waste (Management) Rules 2022; Battery Waste Management Rules 2022; Petroleum Rules 2002.
• NDMA hazard guidelines.
• Digital Personal Data Protection Act 2023: s.8(5).

Frameworks

• NIST SP 800-53 Rev 5: PE-13, PE-14, PE-15, PE-18.
• NIST CSF 2.0: PR.IR-02.
• SOC 2: A1.2. COBIT 2019: DSS01.04, DSS01.05.

Singahi resources: related guides for A.7.1 Physical security perimeters, A.7.8 Equipment siting and protection, A.7.11 Supporting utilities and A.7.12 Cabling security.