Protecting Your Organisation from Physical and Environmental Threats
Threats to information assets are not merely digital: An organisation’s critical physical infrastructure hosting information assets are also exposed to environmental and physical threats that may result in loss, destruction, theft and compromise of information assets and sensitive data.
These threats may include natural events such as earthquakes, floods and wildfires. They may also include man-made disasters such as civil unrest and criminal activities.
Control 7.5 addresses how organisations can assess, identify and mitigate risks to critical physical infrastructure due to physical and environmental threats.
Purpose of Control 7.5
Control 7.5 enables organisations to measure the potential adverse effects of environmental and physical threats and to mitigate and/or eliminate these effects by putting in place appropriate measures.
Attributes Table of Control 7.5
Control 7.5 is a preventive type of control that requires organisations to eliminate and/or mitigate the consequences that are likely to arise out of external risks such as natural disasters and man-made incidents.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #Physical Security | #Protection |
| #Integrity | ||||
| #Availability |
Ownership of Control 7.5
Control 7.5 requires organisations to carry out an in-depth risk assessment before beginning any operations on a physical premise and to implement necessary measures commensurate with the level of risk identified.
Chief security officers therefore, should be accountable for creation, management, implementation and review of the entire process.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
General Guidance on Compliance
Control 7.5 specifies a three-step process to identify and eliminate risks due to physical and environment threats:
- Step 1: Complete a Risk assessment
Organisations should conduct a risk assessment to identify potential physical and environmental disasters that may occur on each specific physical premise and then measure the effects likely to arise due to the identified physical and environmental threats.
Considering that each physical premise and infrastructure therein will be subject to different environmental conditions and physical risk factors, the type of threat and the level of risk identified will vary by each premise and its location.
For instance, while one premise may be most vulnerable to wildfire, another premise may be located in an area where earthquakes occur frequently.
Another critical requirement set forth by the control 7.5 is that this risk assessment should be carried out before launch of operations on a physical premise.
- Step 2: Identify and Implement Controls
Based on the type of threat and the level of risk identified in the first step, organisations should put in place appropriate controls taking into account the likely consequences of the environmental and physical threats.
To illustrate, Control 7.5 provides examples of controls that can be put in place for the following threats:
Fire: Organisations should deploy systems to trigger alarms when a fire is detected or to activate fire suppression systems capable of protecting storage media and information systems from damage.
Flooding: Systems should be deployed and configured to detect flooding in areas where information assets are stored. Furthermore, tools such as water pumps should be ready to be used in case of flooding.
Electrical Surges: Servers and critical information management systems should be maintained and protected against electrical outages.
Explosives and Weapons: Organisations should carry out random audits and inspections on all individuals, items and vehicles entering into premises that hosts critical infrastructure.
- Step 3: Monitoring
Considering that the type of threats and the level of risks may change over time, organisations should continuously monitor the risk assessments and reconsider the controls they implemented if needed.
Supplementary Guidance
Control 7.5 lists four specific considerations that organisations should take into account.
Consultation With Experts
Each specific type of environmental and physical threat, whether it is toxic waste, earthquake or fire, is unique in terms of its nature, the risks it presents and counter-measures it requires.
Therefore, organisations should seek for expert advice on how to identify eliminate and/or mitigate risks arising out of these threats.
Choice of Location for Premises
Taking into account the local topography, water levels and tectonic movements of the potential location for premises can help identify and eliminate risks early on.
Furthermore, organisations should consider the risks of man-made disasters in the chosen urban area such as political unrest and criminal activity.
Extra Layer of Security
In addition to the specific controls implemented, secure information storage methods such as safes can add an extra layer of security against diasters such as fire and flooding.
Crime Prevention Through Environmental Design
Control 7.5 recommends that organisations consider this concept when implementing controls to enhance the security of premises. This method can be used to eliminate urban threats such as criminal activities, civil unrest and terrorism.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences From ISO 27002:2013
27002:2022/7.5 replaces 27002:2013/(11.1.4)
Whereas the the 2013 version addressed how organisations should put in place appropriate preventive measures against physical and environmental threats, the 2022 version is much more comprehensive in terms of specific compliance steps organisations should take.
Overall, there are two key differences:
- 2022 version provides guidance on compliance
The 2013 version did not encompass any guidance on how organisations should identify and eliminate risks due to environmental and physical threats.
The 2022 version, in contract, describes a three-step process organisations should follow, including carrying out a risk assessment.
- 2022 version recommends organisations consider implementing extra layer of measures
In the supplementary guidance, the 2022 version refers to measures such as use of safes and crime prevention through environmental design concepts that can be utilised to enhance protection against threats.
The 2013 version, on the other hand, did not address such additional measures.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
The ISMS.online platform provides a range of powerful tools that simplify the way you can document, implement, maintain and improve your information security management system (ISMS) and achieve compliance with ISO 27002.
The comprehensive package of tools gives you one central place where you can create a bespoke set of policies and procedures that align with your organisation’s specific risks and needs.
Get in touch today to book a demo.
