StudyToCert

All certifications / CISA / Lessons

ISACA Certified Information Systems Auditor (CISA) 2024 job practice · Domain 5: Protection of information assets

Physical and environmental controls

▶ Watch the overview video

Last reviewed September 30, 2026 · Leer en español

Logical controls are useless if someone can walk out with a server, plug a device into a network port in an empty office, or if a flood destroys the data center. Physical and environmental controls protect facilities, equipment, media and the people who work there. They matter for confidentiality and integrity, because physical access often means full access, and above all for availability, because power, heat, water and fire cause many outages. Even when services run in the cloud, the organization still has offices, network closets, laptops and paper records to protect, and it relies on its providers' physical controls, which it assures through contracts and independent reports.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study CISA for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the CISA study plan