Protecting against physical and environmental threats

Plain-language summary

Designing protection against the physical and environmental events that can destroy or disable information assets — fire, flood, lightning, storms, power surges, civil unrest, theft and accidents — based on an assessment of what your sites actually face.

What the clause is really asking

A server room flooded by a burst pipe or a plant data centre lost to fire is an information security incident as much as a hack, and this control asks you to identify the physical and environmental threats to your sites and build protection against them. Start with a risk assessment for each location: natural hazards such as flooding, lightning, storms and fire; human-made threats such as explosion, civil unrest, theft and vandalism; and nearby hazards such as a flammable store or a river. Then protect proportionately: fire detection and suppression suited to electronic equipment, water detection, lightning and surge protection, equipment raised off the floor, and specialist advice where the risk warrants it. The misunderstanding is that the landlord or the insurer has it covered. In South Africa the list is concrete: recent floods in KwaZulu-Natal and the Eastern Cape, the July 2021 unrest in which warehouses were looted, frequent lightning, and surges when power returns after outages. Your ISO 45001 and ISO 14001 emergency preparedness already identifies fire and flood scenarios; extend it to information assets.

What auditors look for

Auditors ask for the physical and environmental risk assessment for each site and check that it names the threats that apply rather than a generic list. They walk the server and network rooms looking for water pipes overhead, equipment on the floor, combustible storage, missing fire detection and the type of extinguisher. They ask for fire detection and suppression service records, surge and lightning protection, and whether water sensors alert anyone. They compare the emergency preparedness plan with the information assets it should cover. The hard question: what happens to the servers if the sprinklers go off or the river floods?

Typical evidence

Physical and environmental risk assessment per site; fire detection and suppression design and service records; water detection and alerting; surge and lightning protection inspection records; emergency preparedness and response plan covering information assets; insurer survey and recommendations; housekeeping inspections of server and network rooms; drill and test records.

How to comply — recommendations

Add information assets to the site emergency risk assessment you already keep for ISO 45001 or your insurer, and score fire, flood, lightning, surge, unrest and theft for the server room, network cabinets and records stores. Move equipment off the floor and away from pipes, keep combustibles out of server rooms, fit smoke detection and an extinguisher suited to electrical fires, and add water sensors that alert a person. Install surge protection at the distribution board and on critical racks. For high-risk sites, keep a copy of critical data at another location. Include the server room in fire drills and inspections.

Common nonconformities

No assessment of physical or environmental threats; server room below water pipes or at flood level; combustible material stored with equipment; no fire detection in the server room, or the wrong extinguisher type; no surge or lightning protection; emergency plan ignores information assets; fire suppression not serviced; all copies of critical data held at one site.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.