Protection of Information Assets · Topic 1 of 8
Security Frameworks and Physical Controls
Security frameworks such as ISO/IEC 27001 and the NIST CSF, the security program, and physical and environmental controls including fire suppression.
- 3 min
- ISO/IEC 27001 is certifiable; 27002 is guidance.
- NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
- Mantraps stop tailgating; visitors are logged and escorted.
What it is
Security frameworks and standards give the organization a structured, recognized way to manage information security, so controls are chosen by risk and cover the whole picture. Physical and environmental controls protect facilities, equipment and media from unauthorized access, theft, fire, water, power failure and other hazards.
How it works
Frameworks and standards
| Framework | Purpose |
|---|---|
| ISO/IEC 27001 | Requirements for an information security management system (ISMS); organizations can be certified against it |
| ISO/IEC 27002 | Guidance on information security controls |
| NIST Cybersecurity Framework (CSF) | Organizes outcomes into functions: Govern, Identify, Protect, Detect, Respond and Recover (version 2.0) |
| COBIT | Governance and management of enterprise IT, including security |
| PCI DSS | Requirements for protecting payment card data |
A security program built on a framework has a policy approved by senior management, defined roles (such as a CISO), a risk assessment, selected controls, awareness training, metrics and regular review. The auditor checks that the program is risk-based, covers all assets and is actually operating, not just documented.
Physical access controls
| Control | Note |
|---|---|
| Perimeter and building security | Fences, guards, lighting, cameras |
| Badge or card access | Logs who enters; access rights reviewed and removed promptly |
| Biometric access | Stronger identity check for sensitive areas |
| Mantrap (access vestibule) | Two doors; only one opens at a time, prevents tailgating |
| Visitor management | Sign-in, identification, escort, badges returned |
| Data center location | Not obvious, not on a ground floor exposed to flooding or below water pipes |
Tailgating and piggybacking, where someone follows an authorized person through a door, are defeated by mantraps, turnstiles and staff awareness.
Environmental controls
| Hazard | Controls |
|---|---|
| Fire | Smoke and heat detectors, fire extinguishers, suppression systems, fire-resistant construction |
| Water | Raised floors, water detectors, location away from pipes |
| Power | Uninterruptible power supply (UPS) for short outages and clean power, generators for long outages, surge protection |
| Temperature and humidity | Air conditioning and monitoring; high humidity causes corrosion, low humidity causes static |
Fire suppression systems
| System | How it works | Note |
|---|---|---|
| Wet pipe sprinkler | Pipes always full of water | Reliable, but leaks and water damage to equipment |
| Dry pipe sprinkler | Pipes fill with water only when the system triggers | Less risk of leaks; slight delay |
| Pre-action | Needs detection before the pipes fill, then heat to release water | Often preferred for data centers using water |
| Gas-based (clean agent) | Suppresses fire without water damage to equipment | Must be safe for people in the room; older halon systems are being phased out |
Physical access rights for departed staff are a common finding. Badge deactivation should be part of the same termination process that removes system access.
How the exam asks about this
- "Which control BEST prevents tailgating into the data center?" A mantrap.
- "Which fire suppression reduces the risk of water leaks in the server room?" Dry pipe or pre-action.
- "What should guide selection of security controls?" A risk assessment within a recognized framework.
What to remember for the exam
- ISO/IEC 27001 is certifiable; 27002 is guidance.
- NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover.
- Mantraps stop tailgating; visitors are logged and escorted.
- UPS for short outages and clean power; generators for long outages.
- Pre-action and dry pipe systems reduce accidental water discharge.
An emergency exit propped open, or a badge reader with a shared code, cancels the strongest physical design.
Common mistakes
Choosing controls from a framework list without a risk assessment.
Forgetting environmental threats such as humidity and water.
Leaving badge access active after termination.
Check yourself
What is the purpose of a mantrap?
To let only one person through at a time and prevent tailgating.
What does a UPS provide that a generator does not?
Immediate, clean power for short outages until systems shut down or the generator starts.
Which ISO standard specifies requirements for an information security management system?
ISO/IEC 27001.
Topic 1 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.