7.5 Protecting against physical and environmental threats
Requires designed and implemented protection against physical and environmental threats. These include natural disasters as well as other physical threats to infrastructure, whether deliberate or accidental.
5
artefacts
0
held by a system
5
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The assessment of physical and environmental threats relevant to each site, covering natural hazards and deliberate and accidental threats · Physical access / facilities
- The protective measures selected against that assessment, such as fire detection and suppression, water detection, and protection against extreme weather · Physical access / facilities
- Testing and maintenance records for protective systems, including fire suppression and detection · Physical access / facilities
- Evidence of siting decisions taking hazard exposure into account, such as flood risk and proximity to hazardous neighbours · Physical access / facilities
- Records of insurance, drills and response arrangements for the identified threats · Physical access / facilities
governing documentDocuments that govern the control
none for this control
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Threat assessment generic rather than site specific, so local flood or seismic exposure was never considered
- Fire suppression maintained while water ingress, which is more common in practice, has no detection at all
- Protective systems installed and never tested, so failure is discovered during the event
- New sites and offices brought into use with no assessment inherited or performed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.4 Physical security monitoring · 7.6 Working in secure areas