What A.7.5 protecting against physical and environmental threats asks for
An auditor who asks how the organization protects its infrastructure from natural and human-caused physical threats is testing whether protection was designed from a risk assessment of each site, not whether a fire extinguisher exists. A.7.5 asks the organization to design and implement protection against physical and environmental threats to its infrastructure, such as natural disasters and other intentional or unintentional physical events like fire, flood and civil unrest. The word that carries the weight is design. The organization should be able to show which threats it considered for each location, why those threats were judged relevant, what protection it chose, and who decided that the remaining risk was acceptable. The control traces back to A.11.1.4, Protecting against external and environmental threats, in the 2013 edition, so organizations that certified under the older standard will recognize the intent, but the 2022 wording expects the site-level reasoning to be written down.
Cross-framework mappings can help with planning but should not be read as equivalence. NIST's crosswalk relates A.7.5 to nine SP 800-53 controls from the Contingency Planning and Physical and Environmental Protection families, including PE-13 and PE-14, and NIST itself cautions that mapped controls are not always equivalent. Use those relationships to find existing evidence, then confirm that each one actually covers the site-level design question your auditor will ask. Confirm the mapping to your own environment rather than assuming it transfers.
The work is hard for three practical reasons. Sites differ in construction, flood exposure, power feeds and occupancy, so one generic standard rarely fits. Many server rooms sit in leased data centers, which means the organization owns the risk assessment but depends on the facility operator for much of the protection, and the contract and the operator's own reports must be checked against what you claim. Evidence is also scattered across facilities teams, landlords, building managers and infrastructure logs. Before the audit, ask each site owner for the most recent threat assessment, the protection measures in place, and the date each measure was last tested or inspected, then decide which gaps need a documented risk acceptance.
Which sites, facilities and suppliers A.7.5 covers
A.7.5 applies to every location where the organization's information infrastructure sits, whether it owns the building, leases space, or depends on a provider. The cards below separate the site types an assessor will ask about and the scoping decisions that change how much evidence the organization must produce itself.
Owned data rooms and server closets
Rooms the organization controls directly are the most straightforward scope item. Confirm the site risk assessment covers flooding from pipes or rainfall, fire suppression, temperature and humidity extremes, and civil unrest or vandalism near the building. Record which threats were judged relevant and why, because A.7.5 is tied to a risk assessment of each site. Check that the protections you rely on, such as detection and suppression systems, are inspected and the inspection records are kept.
Leased colocation space
In colocation, the organization usually owns the racks and equipment but not the building. Decide which physical threats it will manage itself, such as cage layout and rack placement, and which it will rely on the facility operator for. Request the operator's current audit or certification evidence covering its environmental protections, and confirm the contract gives you the right to review it. Your risk assessment should show how that reliance was judged.
Cloud regions as inherited responsibilities
Cloud providers operate the physical facilities that host virtual machines and storage. The organization still must document which A.7.5 protections the provider handles and which it handles, such as backup placement across regions. Collect the provider's independent assurance reports and the shared responsibility documentation for the services in use. Note that the provider's certificates do not transfer automatically to your ISMS; your scope statement must say what you inherit.
Remote and home working sites
Staff working from home or on the road create sites the organization does not own. Decide whether these locations fall within the ISMS scope and, if so, which environmental threats apply, such as fire, water damage, or theft from a vehicle. Often the practical control is a written home-working rule plus a risk acceptance decision rather than physical inspection. Keep the acceptance record and the rules staff acknowledged, since an assessor will look for both.
Third-party facility and maintenance suppliers
Suppliers that enter your premises or operate environmental systems, such as HVAC and fire suppression service firms, affect A.7.5 directly. List them in the supplier register, confirm their contracts set access and reporting expectations, and retain service and inspection reports. Ask each supplier how it protects sites it operates and what it will notify you about after an incident. Decide whether a supplier is in scope for the physical threat analysis or only its records are.
Documenting reliance on provider controls
When the organization relies on a provider's facility controls, the scope decision drives the work. Write down each inherited control, the provider that performs it, the evidence reviewed, and the date of review. Treat the reliance as a risk decision and reassess it when the provider changes its facilities, its certification scope, or the contract terms. Confirm with your certification body how it expects inherited controls to appear in the Statement of Applicability, since presentation varies by body.
How to implement A.7.5 site by site
The sequence turns a general commitment to protect infrastructure into a documented, site-specific set of protections that an auditor can trace from threat to control to evidence. Each step produces an artifact that feeds the next, so the Statement of Applicability entry for A.7.5 rests on a risk assessment the organization can defend.
Inventory sites and information processing locations
Start by listing every site that houses information processing facilities, server rooms, network closets, data storage, backup media or key supporting equipment, including third-party hosting locations the organization controls or contracts for. Record the address, the building owner, the functions at each location and who is responsible for it. Confirm the list with facilities, IT operations and the owners of any colocation or hosted space. The output is a site register that defines the boundary the rest of the work applies to, so a site missing from the register will be missing from the risk assessment and the Statement of Applicability.
Identify threats for each site
For each site, list the physical and environmental threats that could realistically affect the infrastructure there. Typical entries include fire, flood and water ingress, extreme temperature, earthquake or storm exposure where relevant to the location, civil unrest, vandalism and deliberate damage, and failures of nearby infrastructure. Use local hazard information from the relevant national or regional authorities and the building's own history, such as previous incidents or insurer loss records. Facilities and IT staff should walk each site together, since the people who know the building often identify threats that a desk review misses. The output is a threat list per site, with the source of each threat noted.
Assess risk for each site
Score each threat for each site using the organization's existing risk method, based on likelihood, impact on confidentiality, integrity and availability, and the current effectiveness of any protection. Record the existing controls, such as detectors, sprinklers, raised floors or drainage, and whether they were tested. Document the assumptions, including the recovery time the business expects from each site. Ask the site owner to approve the scoring, because it determines how much protection each site needs. The output is a site risk assessment with a ranked list of threats and residual risk, and this document is the basis for every decision in the steps that follow.
Select protections for the ranked risks
Choose protections that match the ranked risks at each site. Common options include fire detection and suppression matched to the equipment and room type, flood mitigation such as leak detection, raised equipment and drainage, structural and environmental monitoring for temperature, humidity and water, and documented response arrangements for civil unrest or access disruption. Consider whether a protection should be physical, procedural or contractual, and who pays for it. Where a risk is accepted rather than treated, record the decision and the approver. The output is a protection plan per site that links each protection to a specific risk line in the site assessment, so no protection exists without a reason.
Assign owners and confirm dependencies
Name one accountable owner for each protection and a backup for each site, separating the people who operate protections from the people who review their records. Confirm dependencies with the teams that supply power, cooling, networking and building services, because a protection that relies on an external utility inherits that utility's failure modes. Link the work to A.7.11 Supporting utilities and A.5.30 ICT readiness for business continuity where those controls apply. The output is an ownership matrix with contact details, escalation paths and documented dependencies that an auditor can ask about.
Implement, test and record each protection
Install or activate the selected protections, then test each one in a way that matches its type. Detectors and alarms can be triggered under controlled conditions, suppression systems and drainage should be checked by their maintainers, and monitoring should be confirmed to alert the named owner. Record the test date, the tester, the result and any defect with a corrective action. Do not rely on vendor documentation alone. The output is a dated test record for every protection, which becomes the primary evidence that the control operates.
Link the risk assessment to the Statement of Applicability
Write the A.7.5 entry in the Statement of Applicability to reference the site risk assessment, the protection plan and the test records, and state whether the control applies to each site. If a site has an exclusion, record the justification and link it to the risk assessment. Review the entry whenever a site changes, a new threat appears or a test fails. The output is an SoA entry that an assessor can follow from the control to the site-level evidence without asking for undocumented explanations. The certification body, not the implementation partner, decides whether this evidence meets the standard.
Review the sequence on a defined cycle
Set a review cycle for each site and trigger an earlier review after any incident, relocation, equipment change, new hazard information or failed test. At each review, repeat the threat identification and risk scoring for the affected sites, update the protection plan and retest the changed protections. Keep the superseded records so that the history of decisions remains available. The cycle length should be set by the organization based on its own risk appetite and contractual obligations, and confirmed with its auditor. The output is a dated review log showing that the protections keep pace with the risks they answer.
How an assessor tests A.7.5
This table sets out what an assessor reviews, how they test it, the evidence they ask for and where A.7.5 most often fails. Read each row as a step in the audit: the site risk assessment comes first, and every later test checks whether the physical protections match the threats that assessment identified.
| Test area | What the assessor does | Evidence requested | Common findings |
|---|---|---|---|
| Site risk assessment | Reads the threat assessment for each site and checks that fire, flood, unrest and other environmental threats are identified for that location | Site-specific risk register, dated assessment records, owner sign-off and the list of threats considered | Generic assessment copied across sites, with no flood, fire or local unrest reasoning tied to the building |
| Walkthrough of the site | Walks the server room, comms rooms, storage areas and plant spaces and compares installed protections with the threats listed in the assessment | Floor plans, asset locations, photographs or notes from the walk, and the site list in scope | Protections exist but do not address the threat listed, such as no water detection in a room below a known flood-prone plant area |
| Fire protection tests | Samples detection and suppression records and checks that tests happened on schedule and that faults were fixed | Service reports for detectors, alarms and suppression systems, test logs and corrective action tickets | Suppression system installed but never tested, or service reports showing open faults with no follow-up |
| Flood and water sensors | Samples sensor placement and checks test records against the sensors listed in the design | Sensor inventory, calibration or function test records, alert routing evidence and response steps | Sensors installed at the wrong height or location, or alerts sent to a mailbox nobody monitors |
| Environmental monitoring | Reviews temperature, humidity and smoke alerts for the period sampled and checks how breaches were handled | Monitoring logs, alert history, escalation records and incident tickets for threshold breaches | Alerts logged but not acted on, or thresholds never reviewed after the site changed |
| Statement of Applicability | Checks that A.7.5 is included or excluded with a reason and that the stated approach matches what the site does | Current SoA entry for A.7.5, linked risk treatment decisions and any related controls such as A.7.8 and A.7.11 | SoA says the control is implemented but cites no site decisions, or the justification no longer matches the sites in scope |
| Continuity link | Checks whether environmental events feed into continuity plans and whether recovery arrangements match the protections claimed | Business continuity plan extracts, recovery test records under A.5.30 and records of plan reviews | Continuity plan assumes a facility survives an event that the site risk assessment rates as likely |
| Records and changes | Samples whether the risk assessment was updated after site moves, fit-outs or new threat information | Change records, dated reviews of the site risk assessment and management review minutes | Assessment last reviewed before a site change, with no record that the change was assessed |
Evidence that passes A.7.5 and how to keep it current
An assessor testing A.7.5 looks for a site-specific picture of threats, the protections designed from it, and proof that those protections still work. The cards below cover the records that connect those three things, and the events that should reopen them. Each record is only as credible as its last review date, so the refresh rules matter as much as the first version.
Site-level threat register
A register listing each facility and the natural and human-caused hazards that apply to it, such as flooding, fire, storm, earthquake, civil unrest and nearby industrial risk. Each entry records likelihood, impact, the owner and the treatment chosen. Check that every site in the ISMS scope has its own entry, because an assessor will sample sites and expect the threats to differ by location. Ask who signs off the register and when it was last reviewed.
Protection design records
Documents that show how each identified threat was addressed in the building and equipment, such as fire compartmentation, flood barriers, raised equipment racks, detection and suppression systems, and separation of server rooms from hazards. Each design decision should trace back to a line in the threat register. Assessors often ask why a risk was accepted without a physical control, so record that reasoning too.
Inspection and maintenance logs
Dated records of inspections and servicing for fire detection, suppression, flood sensors, backup power and cooling, plus any defects found and how they were closed. Logs should name the person or contractor who did the work and the equipment covered. Gaps in these logs are among the most common findings when an assessor compares the design records with what actually happened on site, so schedule reminders and check for missed intervals.
Fire and flood test certificates
Certificates or reports from accredited testers for fire suppression discharge, alarm function, sprinkler integrity and flood barrier performance. Keep the certificate with the site and date it covers. A certificate for a system that has since been modified is weak evidence, so compare the tested configuration with the current design before relying on it.
Monitoring alerts and incident records
Environmental sensor alerts for temperature, humidity, water and smoke, with the response taken and the time it was closed. Pair these with incident records for any real event, such as a water ingress or fire alarm, showing root cause and corrective action. Alerts that fired and were never acknowledged tell an assessor more than a clean dashboard, so review alert handling as well as alert configuration.
Drill records and continuity links to A.5.30
Records of evacuation, fire and flood response exercises, including attendance, observations and actions. Link each exercise to the ICT readiness plans under A.5.30 ICT readiness for business continuity, so the site response and the recovery of systems are shown as one process. Confirm with your own continuity plan which recovery targets and alternate sites are documented, since those values are set by your organization rather than by the standard.
Refresh triggers and annual review
A review of the threat register and protection designs when a site changes, such as a new room, extension, neighboring development or change in equipment load. Also review after a new hazard is published for the area, after an incident, and at least once a year as a planned checkpoint. Record each review even when nothing changes, because the review date itself is evidence that the register is maintained.
What meeting A.7.5 costs in money and effort
This table breaks down the cost components of meeting A.7.5 at each site, who is paid for each one, whether it is one-time or recurring, and what drives it up or down. Use it to build a quote request, because no supplied figures exist for these costs, so every line is a question to put to a provider.
| Cost component | Who is paid or who carries it | One-time or recurring | What drives the cost |
|---|---|---|---|
| Site risk assessment labor | Internal risk staff or an external assessor, plus facilities and engineering staff for site walks | One-time per site, repeated when the hazard profile changes | Number of sites, number of hazard types (fire, flood, unrest, seismic), and whether assessments cover neighboring sites |
| Fire suppression and detection hardware | Equipment vendor and installer, often the building owner or landlord | One-time installation, recurring inspection and servicing | Room size, sensitivity of equipment, local fire codes, and whether suppression is clean-agent or sprinkler-based |
| Flood and water protection | Installer or civil contractor for barriers, drainage and sensors; facilities team for upkeep | One-time build, recurring checks of drains, sump pumps and sensors | Site elevation and location relative to water bodies, and the flood history recorded in the risk assessment |
| Environmental monitoring tooling | Tooling vendor or open-source deployment effort, plus internal or partner staff to configure alerts | Licensing or hosting recurring, configuration one-time | Number of sensors (temperature, humidity, smoke, water), alert routing, and whether data is retained for audit |
| Maintenance and inspection contracts | Service provider for fire, electrical and HVAC-related checks; landlord where the lease requires it | Recurring, usually on a set schedule | Contract term, number of sites, response time requirements, and whether evidence of each visit is delivered to you |
| Drill and testing effort | Internal staff time for evacuation, failover and recovery exercises; external facilitator if used | Recurring each test cycle, plus one-time scenario design | Number of scenarios tested, number of sites involved, and whether drills include unannounced exercises |
| External specialist review | Independent consultant or implementation partner who checks the design against the risk assessment | Usually one-time per review, repeated after material changes | Complexity of the site, number of hazards, and whether the reviewer also prepares the evidence (keep this role separate from the auditor) |
| Auditor sampling time | Certification body, billed under its own agreement with you | Recurring across the three-year certification cycle | Number of sites in scope, sample size the auditor selects, and how well evidence is organized before the visit |
Who owns A.7.5 and what can be outsourced
The organization owns A.7.5 in full. Leadership must decide which threats apply to each site, how much risk it will accept, and which protections are funded. No partner or auditor can make those decisions for you, and an auditor will look for evidence that the decisions were made by people with the authority to make them. The site risk assessment behind A.7.5 is a business judgment about flood exposure, fire load, civil unrest and dependence on the facility, so it should be signed off by an accountable owner rather than delegated silently to a contractor.
- Risk acceptance: Named owners decide which natural, accidental and deliberate threats are treated, transferred or accepted for each site.
- Protection design and funding: Your facilities and security teams approve fire suppression, flood barriers, environmental monitoring and their budgets.
- Operation and testing: Your staff run alarms, drills, inspections and maintenance on a schedule they control.
- Evidence ownership: Risk assessments, inspection logs, incident records and management review minutes stay in your systems and under your retention rules.
- Ongoing review: Your team reassesses each site when the facility, its neighbors or its climate exposure changes.
Before engaging anyone, confirm that a named owner exists for each site and that the risk register states which threats were accepted and by whom.
An implementation partner can prepare the work that supports A.7.5 without taking over the decisions. In practice this means drafting the site risk assessment method, building evidence templates, setting up monitoring and logging for environmental sensors, and producing a test and inspection schedule that your staff then run. Where DeployOpen is engaged, the work is planned and documented in a written, fixed scope before it starts, and the partner's role ends at preparing systems and evidence for the assessment. The partner does not sign off the risk assessment, and it should not certify that the controls work.
- Method and templates: Drafting a repeatable site risk method, evidence templates and a register layout that the organization approves.
- Monitoring setup: Configuring alerting for temperature, humidity, water and power signals, and for self-hosted tooling that records those events.
- Test schedules: Preparing drill and inspection calendars with clear owners, which your team adopts and executes.
- Documentation: Writing runbooks and records of how each protection is operated, so an assessor can follow the trail.
- Scope boundaries: Stating in writing which tasks the partner performs, which your staff perform, and what is excluded.
Before signing, ask the partner to list every deliverable in writing and to confirm that it will not act as the auditor or certify any control.
An independent auditor or certification body tests whether A.7.5 is designed and operating as the organization claims. The auditor samples site risk assessments, inspects protections on site, reviews drill and inspection records, and checks that actions from past incidents were closed. Only an accredited certification body can issue an ISO/IEC 27001 certificate. Under ISO/IEC 17021-1, which accredited certification bodies follow, a certification cycle runs three years with at least one audit every calendar year, so the evidence must hold up across repeated visits rather than a single walk-through.
- Independent sampling: The auditor selects sites and records on its own judgment, not from a list your team prepares.
- On-site verification: Auditors inspect physical protections and ask staff to explain how they respond to alarms and floods.
- Reporting: Findings are reported as conformities or nonconformities, and only the certification body issues the certificate.
- Conflict limits: The auditor cannot design the controls it audits, and a firm that built the protections should not be the one judging them.
- Accreditation check: Confirm the certification body is accredited for ISO/IEC 27001 through the IAF CertSearch database.
Before hiring an auditor, check that it has no design role for the same sites and ask it to describe its independence rules in writing.
Where A.7.5 implementations usually fall short
Most gaps under A.7.5 come from treating physical and environmental protection as a document rather than a set of site-specific decisions. The cards below cover the failure points an assessor is most likely to find, each with a closing action the organization can take before the audit.
One corporate risk assessment for every site
A single enterprise-wide assessment often lists fire, flood and civil unrest in general terms and then applies the same answers to a headquarters, a regional office and a rented rack in a colocation facility. A.7.5 asks for protection based on the risk at each location, so flood exposure at a riverside building or power instability at a remote site needs its own entry. Illustrative example: a data room on an upper floor may need no flood measures, while a basement server room does. Close the gap by recording a separate risk assessment for each site that holds information processing equipment, and naming the site owner who signs it off.
Protections that have never been tested
Fire suppression, water detection, backup generators and environmental sensors are often installed and then left alone. An auditor will ask when each was last tested, who ran the test and what happened. A protection that has never been exercised has not been shown to work, even if the purchase order and installation certificate are on file. Ask the facilities team for the last functional test date for each protection listed in the site assessment.
Inherited colocation controls left undocumented
When systems sit in a colocation facility or a cloud data center, the organization often assumes the provider's fire, flood and environmental protections cover its obligations. Those protections may be real, but the organization still needs to know what they are, how they were tested and where that evidence sits. Without the provider's current facility reports, the organization cannot show the auditor what it relies on. Close the gap by requesting the provider's independent assurance reports and recording which protections the organization inherits and which it must add itself.
Drill records missing or incomplete
Evacuation, fire response and flood or power-loss drills are frequently run but not recorded in a way an assessor can trace. A sign-in sheet with no date, no scenario and no list of corrective actions shows activity but not effectiveness. Drill records should link to the risk the drill tests and to any findings that led to changes in procedure. Confirm that each drill produces a dated record with participants, the scenario, observed problems and the follow-up owner.
Risk assessments not linked to the SoA
The Statement of Applicability should show why A.7.5 is applied and which site-level protections implement it. When the site risk assessments sit in a separate folder with no reference from the SoA, the auditor cannot follow the chain from identified threat to chosen control to evidence. Treat the SoA entry for A.7.5 as the index to the site assessments, and check that each site's treatment decisions can be traced back to the SoA justification.
Questions buyers ask about A.7.5
How much effort does A.7.5 take to meet?
The effort depends on how many sites you run, how exposed each one is to fire, flood, power loss and unrest, and how much of the protection already exists. A.7.5 is not a single product purchase. It requires a documented risk assessment for each site, then protection measures chosen from that assessment and evidence that they work. Organizations with one well-documented data hall usually spend far less than those with several sites, leased space and legacy records. Ask any partner to price the work from a written scope that lists sites, existing assessments and the facilities they must review.
Can we meet A.7.5 in-house without an outside partner?
Yes, if your team has people who can run a site risk assessment, understand building services and write clear records. The control asks you to design and implement protection, so the organization owns the decisions. Teams often struggle with three things: getting facilities staff to produce records, keeping the assessment current after site changes, and testing whether protections such as fire suppression or flood barriers actually function. An outside partner can prepare systems and evidence, but it cannot decide the risk acceptance for you or issue an audit opinion. Only an independent auditor or certification body does that.
What does A.7.5 need from facilities and building teams?
Facilities teams supply the physical facts that an assessor will test. In practice that means:
- Current floor plans and records of how each site is built, including fire zones, drainage and elevation
- Maintenance and test records for fire detection, suppression, water detection and backup power
- Documented responses to natural hazards and civil disruption, along with the contacts who act on them
- Records showing that the site risk assessment was reviewed after changes such as new tenants or equipment moves
Ask facilities to confirm which of these records already exist before the audit planning starts.
Do we need a partner to prepare for A.7.5 evidence?
A partner is not required by ISO/IEC 27001, but many organizations bring one in to prepare systems and evidence when internal capacity is limited. Useful help includes organizing site assessments, collecting maintenance records, mapping evidence to A.7.5 and rehearsing the questions an assessor will ask. The partner should not write the risk acceptance decisions for management, and it should not be the same firm that certifies you. Ask for a written scope with named deliverables before work starts, and confirm how the partner handles independence from your certification body.
How does A.7.5 fit with a colocation or cloud provider's certificate?
A provider's ISO/IEC 27001 certificate covers the scope the provider defined, and that scope often includes data center physical protection. It does not automatically transfer to you. Your organization still needs to confirm that the provider's certified scope includes the sites, services and controls you rely on, and you should request the statement of applicability and the relevant evidence under your contract. For controls at a site you operate, such as an on-premises server room, you must still carry out your own site assessment. Confirm the certificate's scope, validity and issuing certification body through the IAF CertSearch database that ISO points to.
What evidence will an auditor expect to see for A.7.5?
An auditor usually expects a documented site risk assessment, the protection measures chosen from it, and records showing those measures are operating. Typical evidence includes the risk register entries for natural and intentional physical threats, fire and flood protection test records, drills or response exercises, and the review history of each assessment. The auditor will also compare what the documents say with what is on site, so walk the site yourself before the audit and confirm each record matches reality. Gaps often appear in records of testing and in evidence that reviews happened after changes.
How do self-hosted open-source tools help with A.7.5 evidence?
Open-source and self-hosted tools cannot protect a building, but they can hold the records that show protection is maintained. A self-hosted asset register, ticketing system or document repository inside your own infrastructure can store site assessments, test results and review dates with access logs, and link them to the risk register. Monitoring tools can also record environmental sensor readings such as temperature, humidity and water detection where those integrate with your building systems. Confirm each tool's capabilities against its own documentation before relying on it, and keep the evidence under your own control.
How DeployOpen prepares A.7.5 evidence
DeployOpen's part of A.7.5 starts with a written scope. Before work begins, we agree in writing which sites, buildings, server rooms, power and cooling plant, and supporting systems fall within the engagement, and which risk assessment outputs the work will rely on. Most engagements are fixed-scope, so the deliverables and timelines are settled up front. For this control, the central input is the organization's own site-by-site risk assessment, since A.7.5 is only as good as the threats it was designed against. If that assessment does not exist or is out of date, the first deliverable is usually to refresh it, and the organization should decide who signs it off.
Within that scope, DeployOpen prepares the systems and records an assessor will ask to see. For the self-hosted platforms we deploy, this typically means configuration baselines for the monitoring and alerting that cover fire, water, temperature and humidity sensors where they feed into the hosting environment, documented recovery paths for the systems that depend on the site, and evidence that these paths have been exercised. We also prepare the mapping between the threats in the site assessment and the controls that address them, so an auditor can trace each risk to a measure. Where the organization's cloud or colocation provider holds the physical controls, we help define what evidence to request from that provider. The organization owns its controls, its risk decisions and its site. We prepare the systems, controls and evidence for the organization's own assessment.
Only the independent auditor or certification body issues reports or certificates. DeployOpen does not assess the organization's sites, does not attest that A.7.5 is met, and does not issue certification or compliance statements. When you request a quote, ask for the written scope, the list of evidence items to be prepared, the named roles for each deliverable, and what remains with your own facilities and risk teams. Confirm with your certification body how it expects site threat assessments and environmental protection evidence to be presented, and check the certification body's accreditation in the IAF CertSearch database before you commit to an audit date.
