ISO 27001 A.7.5: Protecting against physical and environmental threats

Run a physical and environmental threat assessment for each facility. Go through the list: flood risk (check local flood maps and proximity to water), fire risk (building construction, neighbouring facilities, electrical systems), earthquake risk (seismic zone), severe weather (storms, tornados, lightning), and man-made threats (nearby industrial sites, civil unrest potential, terrorism risk). Use publicly available hazard data to back up your assessment. Put structural and design protections in place. For flood protection: keep critical facilities above potential flood levels, install water detection sensors, waterproof basement areas, and maintain drainage systems. For fire protection: install detection and suppression systems matched to what each area contains, maintain fire-resistant construction, keep fire exits clear, and run regular fire drills. For earthquake zones: make sure structural engineering meets seismic requirements, bolt down equipment racks and heavy items, and set up automatic power shutdown for severe events. Install environmental monitoring. Temperature and humidity monitoring with alerts for critical facilities is non-negotiable. Add water leak detection in any area above or next to equipment rooms. Fit lightning protection including surge arrestors and UPS. Put fire detection with automatic suppression in equipment rooms. Write emergency response procedures for each identified threat. Cover evacuation routes, assembly points, and communication chains. Build relationships with local emergency services before you need them. Keep emergency supplies and equipment on hand. Run drills regularly and capture lessons learned. For critical facilities, think about geographic redundancy. If losing one site would be catastrophic, your backup or disaster recovery site should be far enough away that the same flood, earthquake, or storm cannot take out both locations simultaneously.