Key takeaways
- Set rules for working inside secure areas.
- Secure areas need rules for what people may do inside them.
- Start here: define working rules for secure areas, such as no unsupervised visitors or no personal devices.
Purpose
Set rules for working inside secure areas.
Requirement
Requirement summarySecurity measures for working in secure areas shall be designed and implemented.
Why it matters
Secure areas need rules for what people may do inside them.
How to implement
- Define working rules for secure areas, such as no unsupervised visitors or no personal devices.
- Limit who may enter and why.
- Supervise third-party work inside secure areas.
- Communicate rules with signage and briefings.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.6. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for working in secure areas such as server or records rooms (for example no unaccompanied visitors, no photos).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.6 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of people allowed into secure areas, with approvals.
- Entry records for secure areas showing only authorized people went in.
- Escort records for visitors or contractors in secure areas.
- Signs or notices displaying the rules at the entrance.
Things you should be able to show or explain
- Be able to show that the rules are followed in practice.
How much to show: A few recent entry records for secure areas.
Common mistakes
- Contractors left alone in secure areas.
- No rules written down.
- Contractors left alone in server rooms.
- Rules unknown to the people who enter.
- Tip: No tailgating, no unaccompanied visitors.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.6 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.6?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for working in secure areas such as server or records rooms (for example no unaccompanied visitors, no photos)…