A.7.3 Securing offices, rooms and facilities
Design and apply physical security for offices, rooms and facilities.
16
artefacts
3
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Access control system audit logs · Physical access / facilities
- Visitor log register · Physical access / facilities
- Temperature and humidity monitoring logs · SIEM / log platform
periodic reviewEvidence produced at each review
- Contractor badge issuance records · Physical access / facilities
- Risk assessment for secure areas · Physical access / facilities
- Fire detection and suppression inspection reports · Physical access / facilities
governing documentDocuments that govern the control
- Access control policy document · Policy repository / GRC workspace
- Electronic access card issuance register · Policy repository / GRC workspace
- Key and lock inventory list · Policy repository / GRC workspace
- Visitor pre approval forms · Policy repository / GRC workspace
- Visitor escort procedures document · Policy repository / GRC workspace
- Floor plan with security zones · Policy repository / GRC workspace
- Door and window lock specifications · Policy repository / GRC workspace
- Security camera placement diagram · Policy repository / GRC workspace
- Environmental controls maintenance schedule · Document repository
- Power outage contingency plan · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 3 system-held artefacts from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- informal lock checks replace documented maintenance
- visitor logs missing timestamps or signatures
- floor plans not updated to reflect current security zones
- absence of records for lock and alarm system testing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet