Physical and Technological Controls (ISO/IEC 27002 Clauses 7 and 8)
Domain 4 covers the 14 physical controls in clause 7 and the 34 technological controls in clause 8 - the largest technical block. Questions ask you to map a scenario to the right control and to recognise defence in depth.
Physical controls
Perimeters (A.7.1), entry controls (A.7.2), securing offices and rooms (A.7.3), physical security monitoring (A.7.4), protection against physical and environmental threats (A.7.5), working in secure areas (A.7.6), clear desk and clear screen (A.7.7), equipment siting (A.7.8), off-premises assets (A.7.9), storage media (A.7.10), supporting utilities (A.7.11), cabling (A.7.12), maintenance (A.7.13), secure disposal or re-use (A.7.14).
Technological controls
Identity and access: A.8.1 user endpoint devices, A.8.2 privileged access rights, A.8.3 information access restriction, A.8.4 source code access, A.8.5 secure authentication. Operations: A.8.6 capacity, A.8.7 malware protection, A.8.8 technical vulnerability management, A.8.9 configuration management, A.8.10 deletion, A.8.11 masking, A.8.12 data leakage prevention, A.8.13 backup, A.8.14 redundancy, A.8.15 logging, A.8.16 monitoring, A.8.17 clock synchronisation. Development and change: A.8.25-8.34, including secure development, secure coding, security testing, separation of environments, change management and protection of test information.
Worked example
Laptops are retired from a finance team. Reasoning: A.7.14 requires secure disposal or re-use, A.8.10 requires information to be deleted, and A.5.13 keeps asset records current; for encrypted drives crypto-erasure may be acceptable, but the method must match media type and be evidenced. A disposal vendor is a supplier, so A.5.19-5.22 apply. A deletion command without verification is the failing answer.
Traps
Equating A.8.7 with endpoint antivirus only; treating A.8.8 as scan-and-forget rather than a prioritised remediation cycle; ignoring A.8.32 change management in cloud pipelines; applying A.7.7 only to paper; forgetting that A.8.15 logging needs A.8.16 monitoring and A.8.17 accurate clocks to be useful.