The organization is to design and implement protection for its infrastructure against natural disasters and other physical or environmental hazards, whether deliberate or accidental. Purpose: prevent events arising from physical and environmental threats, or lessen their consequences. Guidance: assess the risks from such threats before critical operations start at a site and at regular intervals afterwards, put the necessary safeguards in place and watch for changes in threats. Obtain specialist advice on handling hazards including fire, flooding, earthquakes, explosions, civil disorder, toxic waste or emissions, and other disasters of natural or human origin. The location and construction of premises should account for local topography (elevation, nearby water, tectonic faults) and urban threats (places likely to attract political unrest, crime or terrorism). Based on the risk assessment, consider controls such as: early fire detection that raises alarms or triggers suppression to protect storage media and systems, using the suppressant best suited to the setting (for example gas in enclosed spaces); early flood detection beneath floors of areas holding media or systems, with pumps or similar readily available; protection of servers and client systems against power surges; and random checks of people, vehicles and goods entering sensitive facilities for explosives or weapons. Other information: safes and secure storage protect contents against fire, earthquake, flood or explosion; crime prevention through environmental design can turn features like statues or water features into barriers instead of bollards.
This control maps to 46 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 7.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 46 it maps to, and the evidence behind each claim, over MCP and REST.