7.1 Physical security perimeters
The organization is to define security perimeters and use them around areas holding information and other associated assets. Purpose: keep unauthorized people out and prevent physical harm to or tampering with the organization's information and assets. Guidance: where appropriate, define each perimeter and decide its location and strength according to the security requirements of the assets inside; make the perimeter of a building or site containing processing facilities physically sound, with no gaps or easy break-in points, solid exterior roofs, walls, ceilings and floors, external doors protected by bars, alarms, locks or similar, doors and windows locked when unattended, added outside protection considered for windows, above all on the ground floor, and ventilation openings taken into account; and alarm, monitor and test every fire door in a perimeter together with the walls so the required resistance is achieved to suitable standards, with the doors failing safe. Other information: protection comes from one or more barriers around the premises and facilities; a secure area might be one lockable office or a group of rooms inside a continuous internal barrier; extra internal barriers may separate areas with different requirements; and measures should be capable of being strengthened when threat levels rise.
Source: ISO/IEC 27002:2022, 7.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Alarm, monitoring and test records for perimeter fire doors, including fail-safe operation · Physical access / facilities
periodic reviewEvidence produced at each review
- Physical security surveys or assessments of walls, roofs, floors, doors, windows and vents · Physical access / facilities
- Records of external door protection such as locks, bars and alarms · Physical access / facilities
governing documentDocuments that govern the control
- Site plans showing defined security perimeters and their strength relative to the assets inside · Policy repository / GRC workspace
- Procedures for locking doors and windows when areas are unattended · Policy repository / GRC workspace
- Plans for strengthening physical measures during heightened threat · Policy repository / GRC workspace
First move
Common gaps auditors find
- False ceilings or raised floors let people bypass walls around secure rooms
- Fire doors on the perimeter are propped open or not alarmed
- Ground-floor windows and ventilation ducts are unprotected
- Perimeters are not reassessed after building alterations
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.8 Information security event reporting · 7.2 Physical entry