Firewalls do not stop someone walking out with a server. That is where ISO 27001 physical security comes in. ISO 27001 physical and environmental security protects offices, data centres and equipment from theft, damage and natural hazards. It also covers everyday habits, such as locking screens and clearing desks.
In the 2013 edition, this was Annex A.11 with 15 controls. The 2022 edition turned it into a full theme, Physical controls (section 7), with 14 controls, including one new control for physical security monitoring. This guide explains them in practical terms.
Mapping: A.11 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.11.1.1 Physical security perimeter | 7.1 Physical security perimeters |
| A.11.1.2 Physical entry controls, A.11.1.6 Delivery and loading areas | 7.2 Physical entry |
| A.11.1.3 Securing offices, rooms and facilities | 7.3 Securing offices, rooms and facilities |
| New in 2022 | 7.4 Physical security monitoring |
| A.11.1.4 Protecting against external and environmental threats | 7.5 Protecting against physical and environmental threats |
| A.11.1.5 Working in secure areas | 7.6 Working in secure areas |
| A.11.2.9 Clear desk and clear screen policy | 7.7 Clear desk and clear screen |
| A.11.2.1 Equipment siting and protection | 7.8 Equipment siting and protection |
| A.11.2.6 Security of equipment and assets off-premises | 7.9 Security of assets off-premises |
| A.11.2.5 Removal of assets | 7.10 Storage media |
| A.11.2.2 Supporting utilities | 7.11 Supporting utilities |
| A.11.2.3 Cabling security | 7.12 Cabling security |
| A.11.2.4 Equipment maintenance | 7.13 Equipment maintenance |
| A.11.2.7 Secure disposal or re-use of equipment | 7.14 Secure disposal or re-use of equipment |
| A.11.2.8 Unattended user equipment | 8.1 User endpoint devices |
ISO 27001 physical security for secure areas: controls 7.1 to 7.6
Perimeters and entry (7.1, 7.2, 7.3)
First, define security zones. For example: public reception, general office, and restricted areas such as server rooms. Then control entry to each zone with:
- access cards, PINs or biometrics;
- visitor registration, badges and escorts;
- logs of who entered restricted areas;
- secure delivery areas, separate from sensitive rooms.
7.4 Physical security monitoring (new)
This new control asks you to monitor premises for unauthorized access. Typical measures include CCTV, intruder alarms and guards. Make sure someone actually reviews alerts, and keep recordings for an agreed period. In addition, follow privacy law when you record people.
7.5 Physical and environmental threats
Next, assess hazards such as fire, flood, earthquakes, heat and civil unrest. Then protect against them with fire detection and suppression, raised floors, water sensors and suitable building locations. For instance, avoid basement server rooms in flood-prone areas.
7.6 Working in secure areas
Set rules for people inside restricted areas. For example, ban photography, limit unsupervised work and lock empty rooms.
Everyday protection: 7.7
A clear desk and clear screen policy is simple but effective. Staff lock screens when they step away, store papers in locked drawers, and collect printouts immediately. As a result, visitors and cleaners cannot read sensitive information.
Equipment: controls 7.8 to 7.14
- 7.8 Siting and protection: place equipment away from hazards and prying eyes.
- 7.9 Assets off-premises: protect laptops and phones when staff travel or work from home.
- 7.10 Storage media: control, encrypt and track removable media.
- 7.11 Supporting utilities: use UPS units, generators and redundant cooling for critical systems.
- 7.12 Cabling security: protect power and network cables from damage and tapping.
- 7.13 Equipment maintenance: follow vendor schedules and supervise external engineers.
- 7.14 Secure disposal or re-use: wipe or destroy storage before disposal, and keep certificates.
Cloud and remote teams
If all your systems run in the cloud, many data centre controls become your provider’s responsibility. Even so, you still need office, home-working and device controls. Check your provider’s certifications and reports, such as ISO 27001 and SOC 2, to cover their part.
What auditors check
- Site walk-through: doors, locks, visitor process and server room.
- Access logs for restricted areas and periodic reviews.
- CCTV coverage and retention.
- Fire suppression and UPS maintenance records.
- Disposal certificates for old disks and devices.
FAQ
Do small offices need CCTV for ISO 27001?
Not always. Control 7.4 asks for monitoring suited to your risk. A small office might use an alarm and access logs instead.
Are home offices in scope?
Yes, when staff handle company information there. Cover them through remote working and endpoint controls.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
