ISO 27001:2022 Annex A Control 7.5

Guidance on ISO 27001:2022 Annex A 7.5 Compliance

ISO 27001:2022 Annex A 7.5 outlines a three-part strategy for recognising and removing potential hazards from physical and environmental sources.

Step 1 – Complete a Risk Assessment

Organisations should carry out a risk assessment to identify any potential physical and environmental hazards that may take place on their premises, then gauge the possible impacts of these identified physical and environmental risks.

Considering the variety of environmental conditions and physical risks each premise and infrastructure may face, the type of threat and the level of risk identified will differ depending on the location.

One property may be particularly vulnerable to wildfire while another may be located in an area prone to earthquakes.

It is essential that a risk assessment is conducted prior to initiating activities on-site, as per Annex A 7.5.

Step 2 – Establish and Employ Controls

Given the type of threat and the associated risk identified initially, organisations ought to implement the correct controls with the possible consequences of environmental and physical threats in mind.

ISO 27001:2022 Annex A 7.5 offers examples of controls that can be implemented to battle different threats:

• Organisations should install systems that can alert them to fires and activate fire suppression systems to safeguard digital media and information systems from destruction.
• Systems should be implemented and set up to identify flooding in locations where data is stored. Additionally, water pumps should be prepared to be utilised in the event of flooding.
• Servers and data-handling systems must be safeguarded against electrical surges. Regular maintenance and protection are essential for optimal performance.
• Organisations should regularly audit and inspect people, items and vehicles entering critical infrastructure sites.

Step 3 – Monitoring

Keep track of progress and make adjustments as necessary. Regularly evaluate results and make changes to ensure objectives are met. Make sure to document any changes for future reference.

Supplementary Guidance on Annex A 7.5

ISO 27001:2022 Annex A 7.5 outlines four considerations which organisations should bear in mind.

Consultation With Experts

Every environmental and physical menace, such as toxic waste, earthquake, and fire, is distinct in terms of its characteristics, the peril it poses, and the measures that must be taken.

Organisations should consult specialist advice on how to detect, reduce, and/or manage risks posed by these threats.

Choice of Location for Premises

Considering the local terrain, water levels, and tectonic activity of a potential site for a building can help identify and eliminate potential risks early.

Organisations ought to contemplate the hazards of human-induced disasters in the selected urban area, for example, political turmoil and criminal behaviour.

Extra Layer of Security

The use of secure storage methods, such as safes, provides an additional layer of protection against disasters like fire and flooding, in addition to the existing security measures in place.

Crime Prevention Through Environmental Design

ISO 27001:2022 Annex A 7.5 suggests that organisations contemplate this concept when introducing controls to strengthen premises security. This approach can be employed to combat urban threats such as criminal activities, civil unrest, and terrorism.

Changes and Differences From ISO 27001:2013

ISO 27001:2022 Annex A 7.5 replaces ISO 27001:2013 Annex A 11.1.4 in the revised standard.

The 2013 version focused on how organisations should put preventive measures in place against physical and environmental threats, while the 2022 version is more comprehensive, outlining the specific steps organisations should take to comply.

In conclusion, two main distinctions stand out.

The 2022 Version Offers Advice on Meeting Regulations

The 2013 edition provided no guidance on how organisations could recognise and reduce risks caused by environmental and physical hazards.

The 2022 version outlines a three-step process that organisations must implement, beginning with a risk assessment.

The 2022 Revision Encourages Organisations to Introduce an Extra Layer of Measures

The supplementary guidance for 2022 includes the use of safes and crime prevention through environmental design as ways of boosting security against threats.

In 2013, however, no extra steps were taken.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

The ISMS.online platform offers a variety of potent tools to make documenting, implementing, preserving and enhancing your information security management system (ISMS) and becoming compliant with ISO 27001:2022 easier.

This comprehensive collection of tools provides a single location where you can customise a set of policies and procedures to match your organisation’s particular risks and necessities.

Contact us today to arrange a demonstration.