ISO 27001 Annex A 7.5 Protecting against physical and environmental threats

This control is broader than ISM-0194.

Annex A 7.5 requires protection against physical threats to infrastructure, including preventing unauthorised physical access or tampering. ISM-0194 relates by requiring conduit joints and certain TOP SECRET conduits in shared facilities to be visibly sealed, helping deter or reveal physical tampering with cable pathways. ISM-0194 is a narrow physical hardening/tamper-evidence technique for specific classified infrastructure, while Annex A 7.5 has wider scope across physical and environmental threats.

This control is broader than ISM-0195.

Annex A 7.5 requires protections to prevent or reduce harm from intentional or unintentional physical threats to infrastructure. ISM-0195 is a targeted anti-tamper measure, requiring SCEC-approved tamper-evident seals on removable covers for TOP SECRET cable reticulation systems in shared facilities. Annex A 7.5 covers this kind of physical tamper protection but also extends to environmental hazards and broader facility resilience controls.

This control is broader than ISM-0216.

Annex A 7.5 requires organisations to implement protections against physical threats to infrastructure, including preventing unauthorised access and interference. ISM-0216 is a specific facility/cabling segregation control requiring TOP SECRET patch panels to be installed in individual TOP SECRET cabinets, reducing tampering and disclosure risk. Annex A 7.5 is broader as it applies to all infrastructure and includes environmental threats, not just TOP SECRET patch panel housing.

This control is broader than ISM-0813.

Annex A 7.5 requires organisations to design and implement protections against physical and environmental threats to infrastructure. ISM-0813 contributes to that outcome by requiring server rooms, communications rooms and security containers not be left unsecured, reducing exposure to intentional physical threats (e.g. theft, tampering). Annex A 7.5 is broader because it also encompasses environmental hazards (e.g. fire, flood) and other facility protections beyond 'not left unsecured'.

This control is broader than ISM-1074.

Annex A 7.5 requires safeguards that protect infrastructure from physical threats and environmental events. ISM-1074 is a specific physical security measure that controls keys or equivalent access mechanisms to critical rooms and containers, reducing the likelihood of unauthorised physical access and interference. Annex A 7.5 is wider in scope because it also expects design/implementation of controls for environmental threats and resilience measures, not just key control.

This control is broader than ISM-1116.

Annex A 7.5 requires organisations to design and implement measures that protect physical infrastructure from threats, including preventing compromise through physical proximity or interference. ISM-1116 requires a visible gap between TOP SECRET and non-TOP SECRET cabinets, reducing accidental cross-access, tampering opportunities and handling errors in physical environments. Annex A 7.5 is broader because it applies across classifications and also includes environmental threat protection (e.g. fire, water, smoke, heat).

This control is broader than ISM-1164.

ISM-1164 requires clear plastic cable containment in shared facilities to improve visibility and make concealed physical interference with cabling more difficult. This aligns with ISO/IEC 27001:2022 Annex A 7.5 because it is a designed protection against intentional physical threats to infrastructure (specifically, covert tampering with data/power cabling). Annex A 7.5 is broader, covering a wide range of physical and environmental threats and design measures (including fire, flood, theft and sabotage), whereas ISM-1164 addresses a narrow tamper-evidence measure for shared-area cabling routes.

This control is broader than ISM-1645.

ISM-1645 requires organisations to develop, maintain, and regularly verify floor plan diagrams to ensure the diagrams accurately represent the environment. This supports Annex A 7.5 by ensuring the organisation has current layout information needed to design and validate protections against physical and environmental threats (e.g., fire exits, flood-prone areas, secured plant rooms, and critical infrastructure locations). Annex A 7.5 is broader because it mandates implementing threat protections, while ISM-1645 is about keeping the underlying facility documentation current and verified.

This control is broader than ISM-1973.

Annex A 7.5 requires organisations to implement protections against physical threats (e.g. unauthorised access, vandalism) and environmental threats (e.g. fire, flood) to infrastructure. ISM-1973 relates by requiring non-classified systems to be secured in suitably secure facilities, addressing physical protection of assets. ISM-1973 is a subset focused on facility security for systems, while Annex A 7.5 extends to environmental resilience measures and other infrastructure components.

This control partially overlaps ISM-0734.

Annex A 7.5 requires organisations to design and implement protection against physical and environmental threats, including natural disasters affecting infrastructure. ISM-0734 relates by requiring the CISO to contribute to business continuity and disaster recovery planning to ensure critical services can be supported during disasters. The overlap is in disaster-related risk treatment, but ISM-0734 focuses on governance and recovery planning, while Annex A 7.5 focuses on preventative/protective physical and environmental safeguards.

This control partially overlaps ISM-1119.

ISM-1119 requires cables in TOP SECRET areas to be fully inspectable for their entire length to reduce the risk of undetected physical compromise. Annex A 7.5 requires protection against physical and environmental threats to infrastructure, which may include design choices for cable routing and containment to prevent damage and facilitate maintenance/inspection. The controls overlap on protecting physical infrastructure, but Annex A 7.5 has a wider hazard focus (environmental and other threats) while ISM-1119 is specifically about inspectability to detect tampering/interception in high-security zones.

This control partially overlaps ISM-1296.

ISM-1296 requires protecting network devices in public areas from physical damage and unauthorised access. ISO/IEC 27001:2022 Annex A 7.5 requires protection against physical and environmental threats to infrastructure, including intentional and unintentional physical threats. They overlap in mitigating physical damage risks to exposed network devices (e.g., impact, vandalism), but Annex A 7.5 also covers wider environmental and disaster scenarios, while ISM-1296 additionally emphasises preventing unauthorised physical access/tampering in public spaces.

This control supports ISM-0810.

Annex A 7.5 requires organisations to implement protections against physical and environmental threats to infrastructure. ISM-0810 supports this by requiring classified systems to be secured in facilities that meet security zone requirements suitable for their classification, which underpins physical threat containment and controlled environments. Annex A 7.5 is broader and threat-focused (including natural disasters and unintentional hazards), while ISM-0810 is primarily about classification-aligned zoning requirements.

This control supports ISM-1053.

Annex A 7.5 requires organisations to protect infrastructure from physical and environmental threats through appropriate design and implementation. ISM-1053 supports this by requiring classified servers, network devices and cryptographic equipment to be secured in rooms that meet security zone requirements, which reduces physical compromise and provides a controlled environment for further environmental protections. Annex A 7.5 is broader as it explicitly encompasses environmental threat controls and applies across all infrastructure, not only classified equipment and zones.