A.7.5 Protecting against physical and environmental threats

Status: Not Applicable

Justification:

This control is not applicable because anDREa does not own, lease, or maintain any physical corporate infrastructure, offices, or localized data centers. The organization operates on a 100% fully remote work model, with all corporate systems and data hosted entirely within third-party, cloud-managed infrastructures (SaaS/PaaS/IaaS). Consequently, the design and implementation of facility-level protections against natural disasters and environmental hazards fall outside the entity's direct operational scope. Physical and environmental security risks at the user level are mitigated through endpoint security measures and remote working protocols governed under Control A.06.07 (Remote Working).