Which threat could occur if no physical measures are taken?

The question asks for a threat that could occur if no physical measures are taken. A server shutting down due to overheating is a direct consequence of a failure in physical environmental controls, such as inadequate cooling, ventilation, or temperature monitoring systems. These are fundamental components of physical security for information processing facilities as defined within the ISO 27001 framework. Unlike other options, this threat is almost exclusively mitigated by physical measures (e.g., HVAC systems, server room design) and cannot be effectively prevented by logical or administrative controls alone.

A. Unauthorised persons viewing sensitive files: This can be prevented by logical controls like password-protected screen savers, file encryption, and access control lists, even if physical access is gained.

B. Confidential prints being left on the printer: This can be mitigated by technical controls like "secure print" or "follow-me printing," which require user authentication at the device before a document is released.

D. Hackers entering the corporate network: This is primarily a logical threat prevented by technical controls such as firewalls, intrusion detection systems, and network segmentation, rather than just physical measures.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Control 7.4: Protecting against physical and environmental threats. This control's purpose is "to protect information processing facilities from physical and environmental threats." The guidance explicitly mentions threats such as "extremes of temperature and humidity" and the need for appropriate detection and protection measures. The failure to implement these physical measures directly leads to threats like overheating.

2. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Chapter 13, Section A.11.2.2 Supporting utilities: This section details the ISO 27001 control requiring equipment to be "protected from power failures and other disruptions caused by failures in supporting utilities." It explicitly lists "heating, ventilation and air-conditioning" as critical utilities. A lack of these physical measures directly exposes servers to the threat of overheating.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Chapter 11, Physical and Environmental Security (Annex A.11): This chapter explains that the objective of this control domain is to prevent "damage from or interference with the organization's information and information processing facilities." It discusses the necessity of protecting against environmental factors, where overheating is a primary example of a threat resulting from failed environmental controls.