Key takeaways
- Define and protect the boundaries of areas holding sensitive information.
- Physical boundaries keep unauthorised people away from your information and equipment.
- Start here: define secure areas and their perimeters.
Purpose
Define and protect the boundaries of areas holding sensitive information.
Requirement
Requirement summarySecurity perimeters shall be defined and used to protect areas that contain information and other associated assets.
Why it matters
Physical boundaries keep unauthorised people away from your information and equipment.
How to implement
- Define secure areas and their perimeters.
- Use walls, locked doors and reception points appropriate to the risk.
- Protect perimeters for shared offices, data rooms and storage.
- Document arrangements for cloud-only or co-working situations.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your physical security policy, defining the secure boundary around offices and equipment rooms.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.1 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Site plans or notes showing entry points and how they are secured.
- Maintenance records for doors, locks and alarms.
Things you should be able to show or explain
- Be able to show that entrances are secure and in good condition.
How much to show: Walk around each in-scope site.
Common mistakes
- Doors propped open.
- No boundary defined in shared buildings.
- Fire doors propped open.
- Assuming the landlord covers everything without checking.
- Tip: Map your secure areas on a floor plan.
Policies & documents to have
- ISMS scope statement
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.1 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.1?
Be ready to explain how the control works in your organisation and to provide things like: Your physical security policy, defining the secure boundary around offices and equipment rooms…