Physical security perimeters
Purpose
Stop unauthorised people from physically reaching, damaging or interfering with the organisation's information and supporting assets.
How to meet this control
In short: Define and use security perimeters to protect areas with information assets.
- Step 01Map the site into security zones and define a perimeter for each, with stronger barriers protecting higher-value areas such as comms and server rooms
- Step 02Use solid construction, controlled external doors with locks or alarms, and secured windows and ventilation points at ground level
- Step 03Place a staffed reception or controlled lobby so visitors cannot pass into working areas unchallenged
- Step 04Alarm and regularly test fire doors and emergency exits so they fail safe without becoming an uncontrolled entry point
- Step 05Create internal barriers, such as locked doors or partitions, between zones of differing sensitivity
- Step 06Review perimeter strength when the threat level or tenancy changes and document the zoning
Tip: Locked doors, reception, and zoning of sensitive areas.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Define security perimeters and set their strength according to the value of the assets inside
- ›Make perimeters physically solid with no gaps, using sturdy walls, roofs, floors and protected doors
- ›Fit external doors with controls such as locks, bars or alarms, and lock them when unattended
- ›Add extra protection for windows, especially at ground level, and secure ventilation points
- ›Alarm, monitor and regularly test all fire doors so they meet the required standard and fail safely
- ›Create internal barriers between zones that have different security needs
- ›Be ready to strengthen physical measures when the threat level rises
Audit evidence to keep
- - A site or floor plan showing defined security zones and perimeters
- - Photographs or records of locks, alarms and reinforced doors
- - Fire-door and alarm test records
- - The physical security policy describing zoning and perimeter standards
- - Records of perimeter review after a change in occupancy or threat
Common mistakes
- - Relying on office trust without logs
- - Not tracking assets used away from the office
- - Disposing equipment without wipe or destruction evidence
Owner, cadence, and proof
Assign one accountable owner for A.7.1. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.