ISO 27001 Annex A 7.5: physical and environmental threats

The due-diligence questionnaire asks how you protect your offices from fire, flood and power loss. Your workloads run in AWS, so someone suggests marking ISO 27001 Annex A 7.5 as not applicable. Then the auditor asks to see the comms room.

This guide covers what the control requires, how to run a proportionate hazard assessment, which safeguards suit a leased office, what auditors sample on the walkthrough and how to make the evidence assemble itself. It is written for security officers and operations leads at UK firms of 25 to 250 people who want to pass the audit without buying hardware the building doesn't need.

Our approach treats the dated site assessment as the control and every safeguard as a proportionate response to it. Run that way, the evidence builds up as a by-product of looking after the office, not a folder assembled the week before the audit.

What does ISO 27001 Annex A 7.5 require?

ISO 27001 Annex A 7.5 requires you to assess the physical and environmental hazards at each site, such as fire, flooding, power failure and vandalism, before relying on it. You then fit safeguards proportionate to what the assessment finds and revisit it periodically, so protection keeps pace with change.

The 2022 edition titles the control "Protecting against physical and environmental threats". It is an assess-then-respond exercise, not a hardware shopping list. Where the building actually sits shapes the hazards: near a river, on a flood plain, or somewhere that attracts unrest.

The standard expects the assessment before critical operations depend on a site, with specialist input where the risk justifies it. A new office that will host anything critical therefore gets its assessment before go-live, as a line on the new-site checklist.

The control's classification tells you how to scope it:

• Preventive. The point is to stop environmental events damaging assets, or blunt their consequences, before they land.
• Availability first. Fire, flood and power loss take services down. Integrity (damaged media) and confidentiality (assets exposed in the chaos of an incident) follow.
• Assessment-driven. The safeguards follow from a risk assessment, so the control lives in your risk register as much as in the building.

The control sits beside equipment siting (A.7.8) and supporting utilities (A.7.11). This one asks what could hit the site; those two ask where kit sits inside the building and what keeps it running.

Can cloud-first firms mark ISO 27001 Annex A 7.5 not applicable?

Rarely. The hyperscaler covers its own data centres, but your office comms room, network uplinks, laptops and paper records remain yours to assess. A short, honest assessment showing the residual scope is small is the defensible answer; a blanket 'not applicable' with no assessment behind it is not.

Most of the environmental risk does sit with AWS or Azure. What stays with you is exactly what this control catches: the comms room where a burst pipe takes out the only link to everything, the on-premises file server under an air-conditioning unit, the paper records a fire turns into a regulatory incident.

Availability failures of this kind hit regulated firms twice. They hurt operationally, and then the regulator and clients ask why single points of failure sat unassessed. Auditors, insurers and enterprise due-diligence teams all put the same question underneath their wording: did anyone actually look at what could take this site out?

A short assessment for a cloud-first firm usually covers four things:

• The comms room and uplinks. What sits there, what runs above it, and what happens if the link goes down.
• Laptops and portable media. Where they are kept and what a fire or theft at the office would cost.
• Paper records. Anything irreplaceable that would turn a fire into a regulatory incident.
• Any on-premises kit. A file server, NAS or printer-scanner estate that never made it to the cloud.

Write down the residual risk and who accepted it. "We assessed it and accepted the residual risk" is a strong answer, while "we never thought about it" is the one that draws a finding.

How do you run a site hazard assessment for A.7.5?

Run a half-day, site-by-site assessment and record it in your risk register: what is physically at each location, which hazards could plausibly hit it, and the impact. Use free official data, such as the Environment Agency long term flood risk service, to ground the location-specific view. That document becomes the control's backbone.

Work through five steps for each site:

1. Inventory what is physically there. Comms or server room, paper records, staff devices, and where power and network lines enter the building.
2. Name the plausible hazards. Fire, water ingress, power loss, theft and vandalism, plus anything the postcode suggests.
3. Score the impact. Use your existing risk-register scale and ask what happens if the building loses power for a day or the comms room floods.
4. Decide to treat or accept. Record the decision, the owner and the date.
5. Set the review trigger. Revisit on your normal risk-review cycle and after any move, fit-out or near-miss.

The flood service maps risk from rivers and the sea, surface water, reservoirs and, where data is available, groundwater. It covers England only, so sites in Scotland, Wales or Northern Ireland need their own national service. Whatever the source, the auditor wants location-specific thinking. A generic template that could describe any building won't show it.

Do this after your zoning work under A.7.1 (physical security perimeters) and A.7.3 (securing offices, rooms and facilities) has shown where assets concentrate. The results then feed business continuity planning, because the residual risks you accept here are exactly what continuity arrangements must absorb. At 50-person scale, the remediation it triggers is usually days of work, not weeks.

Which safeguards are proportionate for a leased office comms room?

For a typical leased office the safeguard set is short: landlord-run detection and alarms with evidence held, sensible fire protection for the comms room, kit raised away from water runs, a low-cost leak sensor, and surge-protected UPS power. Gas suppression is rarely proportionate; siting and cheap telemetry usually suffice.

Siting does most of the work. The FedRAMP NIST SP 800-53 Rev. 5 PE-18 Control Catalogue sets the same expectation: position components within the facility to minimise damage from environmental hazards. In a comms room that means nothing critical sits directly beneath pipework or an air-conditioning drip tray.

Check the cheap physical wins first:

• No clutter by the kit. Cardboard, spare furniture and flammable storage don't belong next to the switches.
• Tidy cabling. Cable spaghetti hides faults and feeds fires.
• Equipment off the floor. Racks and devices sit up and away from water runs.
• A leak sensor where water risk is real. It costs little compared with the outage it prevents.
• Surge-protected UPS power. A UPS is the battery unit that rides out short outages and allows a clean shutdown.
• A fire-rated safe for irreplaceable media. Better still, digitise the documents and remove the category.

Pricing gas suppression before the hazard assessment is guessing with a purchase order.

A rented office whose real exposure is a dripping AC unit needs a shelf higher up and a sensor beneath the unit, not seismic bracing.

Where you genuinely run your own server room, step up. Fit early smoke detection, suppression suitable for an enclosed space with electronics, leak detection under raised floors, and environmental monitoring with alerts. Bring in a fire engineer or facilities consultant rather than improvising. For everyone else, this short list satisfies both the auditor and the enterprise buyer reading your questionnaire answers.

What if physical security conflicts with fire safety rules?

Fire safety wins. Under Article 14 of the Regulatory Reform (Fire Safety) Order 2005, emergency doors must never be locked or fastened so they cannot be opened easily and immediately by anyone needing them. Design access control so people can always get out, and manage the exposure with exit alarms, not locks.

The Regulatory Reform (Fire Safety) Order 2005 (Article 14) goes further than locks. Emergency doors must open in the direction of escape, and sliding or revolving doors cannot serve as dedicated emergency exits. The duty sits with the premises' "responsible person", and auditors check the thinking behind your door design.

A door that fails locked in an evacuation is a finding in two management systems at once: your ISO 27001 audit and your fire risk assessment. That is a worse outcome than the tailgating risk you were trying to prevent.

To keep both sides satisfied:

• Confirm door behaviour. Ask your landlord or fire risk assessor what each secure door does when the alarm sounds, and write down the answer.
• Alarm the exits. An alarm on a fire exit flags misuse without trapping anyone.
• Cover the exposure elsewhere. Use cameras, visitor controls and zoning to offset the weaker perimeter.
• Record the decision. Put the conflict and your resolution in the hazard assessment so the auditor sees the reasoning.

What evidence does an auditor expect for A.7.5?

The anchor evidence is the site hazard assessment showing location-specific thinking, plus the treatment decisions that followed. Around it sit maintenance and inspection records for extinguishers, alarms, UPS and HVAC, sensor output, incident logs, landlord certificates you actually hold, and a Statement of Applicability entry stating how the control is met.

Each item ties back to the assessment:

• Site hazard assessment. Dated, per site, held in the risk register with a named owner and review trigger.
• Treatment decisions. The safeguards you fitted or the residual risks you accepted, linked to the assessment line that prompted them.
• Maintenance and inspection records. Service history for extinguishers, alarms, UPS batteries and HVAC, whether the work is yours or the landlord's.
• Sensor output and incident logs. Alert history from the comms room, plus any water, power or fire near-misses and what changed afterwards.
• Statement of Applicability entry. Your register of applicable controls, stating how this one is met and pointing at the items above.

A landlord's fire certificate you have never seen is an assumption, not evidence.

In shared buildings the landlord's fire-safety and maintenance evidence counts toward the control. Ask for the certificates at a fixed point each year and file them where the auditor can find them, ideally attached to the ticket that tracks the renewal.

What do auditors check on the A.7.5 site walkthrough?

Auditors trace your assessment against the real site: they look up in the comms room for pipework you did not mention, check extinguisher and UPS battery service dates, ask what the secure doors do when the alarm sounds, and test whether escalation contact lists still name current staff.

Expect questions like these in the room:

• "Show me the environmental risk assessment for this site. What did it consider, and when was it last revisited?"
• "What happens to your operations if this building loses power for a day?"
• "Who maintains the fire protection here, and where is the evidence it is in date?"
• "What is directly above and around your comms room?"
• "Have you had any water, power or fire near-misses, and did anything change as a result?"

The visit is a sampling exercise, so the weak points show quickly. Three patterns account for most trips:

• Blind reliance on the landlord. Extinguisher and alarm servicing lapses because it is "the landlord's thing" and nobody holds the evidence.
• A room that has drifted from its assessment. The paperwork was right when it was written, but the comms room has since become a store, or a new rack went in under the AC unit because that is where it fitted.
• Stale escalation lists. Sensor and alarm contacts still name people who have left.

An alert that routes to someone who left isn't monitoring.

The near-miss question catches firms that never record incidents. A logged burst-pipe scare with a documented change afterwards, such as moving the rack, is stronger evidence than a clean sheet nobody believes.

How do you automate ISO 27001 Annex A 7.5 evidence?

Automate four things: environmental sensors feeding your existing alerting, maintenance as recurring tickets with attachments, escalation contacts tied to the HR leaver process, and reassessment tasks triggered by office moves or fit-outs. The service history then assembles itself, and lapses surface before the auditor finds them.

Each one replaces a habit that depends on memory:

• Sensors into existing alerting. Cheap temperature, humidity and leak sensors in the comms room, feeding Slack or your monitoring stack, turn "we check the room sometimes" into continuous evidence.
• Maintenance as recurring tickets. Extinguisher checks, UPS battery tests and landlord certificate renewals become scheduled tasks with the certificate attached on completion.
• Contact lists tied to the roster. When HR records a leaver, the escalation path for environmental alarms is reviewed automatically, which kills the stale-callout-list pitfall.
• Reassessment on triggers. An office move or fit-out project in your ticketing system spawns the reassessment task, so reassessment after a significant change happens by mechanism, not memory.

At this scale the setup is an afternoon of configuration. The payoff arrives when an enterprise buyer or insurer asks for your physical-security evidence and you export it in minutes, with the service history already attached.

Frequently asked questions