What it asks for. Design and implement protection against physical and environmental threats such as natural disasters, fire, flooding, extreme weather and other deliberate or accidental physical events affecting infrastructure.
In practice. Sites are assessed for relevant threats before selection and periodically afterwards, using sources such as flood maps and local risk data. Controls follow from the assessment: fire detection and suppression, water leak detection, raised floors, temperature monitoring, structural protection and secure placement of critical equipment. Specialist advice is taken where needed, and the results inform business continuity plans. Auditors expect the threat assessment, maintenance and test records for protective systems and alignment with continuity arrangements.
Common gaps. Assessments are often done once at site selection and not revisited as climate and local conditions change. Data centre providers are relied upon without checking their protections, and small branch sites receive no assessment at all.