Threats to information assets are not merely digital: An organisation’s critical physical infrastructure hosting information assets are also exposed to environmental and physical threats that may result in loss, destruction, theft and compromise of information assets and sensitive data.
These threats may include natural events such as earthquakes, floods and wildfires. They may also include man-made disasters such as civil unrest and criminal activities.
Control 7.5 addresses how organisations can assess, identify and mitigate risks to critical physical infrastructure due to physical and environmental threats.
Control 7.5 enables organisations to measure the potential adverse effects of environmental and physical threats and to mitigate and/or eliminate these effects by putting in place appropriate measures.
Control 7.5 is a preventive type of control that requires organisations to eliminate and/or mitigate the consequences that are likely to arise out of external risks such as natural disasters and man-made incidents.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Physical Security | #Protection |
Control 7.5 requires organisations to carry out an in-depth risk assessment before beginning any operations on a physical premise and to implement necessary measures commensurate with the level of risk identified.
Chief security officers therefore, should be accountable for creation, management, implementation and review of the entire process.
Control 7.5 specifies a three-step process to identify and eliminate risks due to physical and environment threats:
Organisations should conduct a risk assessment to identify potential physical and environmental disasters that may occur on each specific physical premise and then measure the effects likely to arise due to the identified physical and environmental threats.
Considering that each physical premise and infrastructure therein will be subject to different environmental conditions and physical risk factors, the type of threat and the level of risk identified will vary by each premise and its location.
For instance, while one premise may be most vulnerable to wildfire, another premise may be located in an area where earthquakes occur frequently.
Another critical requirement set forth by the control 7.5 is that this risk assessment should be carried out before launch of operations on a physical premise.
Based on the type of threat and the level of risk identified in the first step, organisations should put in place appropriate controls taking into account the likely consequences of the environmental and physical threats.
To illustrate, Control 7.5 provides examples of controls that can be put in place for the following threats:
Fire: Organisations should deploy systems to trigger alarms when a fire is detected or to activate fire suppression systems capable of protecting storage media and information systems from damage.
Flooding: Systems should be deployed and configured to detect flooding in areas where information assets are stored. Furthermore, tools such as water pumps should be ready to be used in case of flooding.
Electrical Surges: Servers and critical information management systems should be maintained and protected against electrical outages.
Explosives and Weapons: Organisations should carry out random audits and inspections on all individuals, items and vehicles entering into premises that hosts critical infrastructure.
Considering that the type of threats and the level of risks may change over time, organisations should continuously monitor the risk assessments and reconsider the controls they implemented if needed.
Control 7.5 lists four specific considerations that organisations should take into account.
Each specific type of environmental and physical threat, whether it is toxic waste, earthquake or fire, is unique in terms of its nature, the risks it presents and counter-measures it requires.
Therefore, organisations should seek for expert advice on how to identify eliminate and/or mitigate risks arising out of these threats.
Taking into account the local topography, water levels and tectonic movements of the potential location for premises can help identify and eliminate risks early on.
Furthermore, organisations should consider the risks of man-made disasters in the chosen urban area such as political unrest and criminal activity.
In addition to the specific controls implemented, secure information storage methods such as safes can add an extra layer of security against diasters such as fire and flooding.
Control 7.5 recommends that organisations consider this concept when implementing controls to enhance the security of premises. This method can be used to eliminate urban threats such as criminal activities, civil unrest and terrorism.
27002:2022/7.5 replaces 27002:2013/(11.1.4)
Whereas the the 2013 version addressed how organisations should put in place appropriate preventive measures against physical and environmental threats, the 2022 version is much more comprehensive in terms of specific compliance steps organisations should take.
Overall, there are two key differences:
The 2013 version did not encompass any guidance on how organisations should identify and eliminate risks due to environmental and physical threats.
The 2022 version, in contract, describes a three-step process organisations should follow, including carrying out a risk assessment.
In the supplementary guidance, the 2022 version refers to measures such as use of safes and crime prevention through environmental design concepts that can be utilised to enhance protection against threats.
The 2013 version, on the other hand, did not address such additional measures.
The ISMS.online platform provides a range of powerful tools that simplify the way you can document, implement, maintain and improve your information security management system (ISMS) and achieve compliance with ISO 27002.
The comprehensive package of tools gives you one central place where you can create a bespoke set of policies and procedures that align with your organisation’s specific risks and needs.
Get in touch today to book a demo.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
