Why it matters
Server rooms, comms cabinets, or even a locked drawer for sensitive paperwork all need proportionate physical protection.
How a self-led small team implements it
If you're fully cloud-based with no server room, state that explicitly as your justification for marking this not applicable.
What auditors expect to see
Facility security description or applicability justification.
Track A.7.3 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS