7.2 Physical entry
Secure areas are to be protected by suitable entry controls and access points. Purpose: allow physical access to information and assets only to those authorized. General guidance: entry points like loading bays and goods-in, and anywhere unauthorized people could get in, are controlled and where possible kept apart from processing facilities. Consider: restricting sites and buildings to authorized people, with physical access rights provided, reviewed, updated and revoked (5.18); recording every entry in a protected paper log or electronic trail that is watched, and safeguarding those logs (5.33) and sensitive authentication information; a process and technical means to govern entry to rooms that hold or process information, using cards, biometrics or two-factor methods such as card plus PIN, and double doors for sensitive areas; a staffed reception or other means of controlling entry; inspecting personal belongings on entry and exit where local law permits; visible identification for everyone, prompt reporting of unescorted or unbadged people, and distinguishable badges for staff, suppliers and visitors; supplier access to secure areas only when needed, authorized and monitored; extra attention in buildings shared with other organizations; measures that can be stepped up when physical risk rises; protecting secondary entrances like fire exits against misuse; and a key management process for physical keys and lock codes or combinations, with a logbook or yearly key audit and controlled access (5.17). Visitors: authenticate their identity, record arrival and departure times, admit them only for specific authorized purposes with briefings on the area's security rules and emergency procedures, and keep them supervised unless expressly exempted. Goods-in areas: restrict outside access to identified, authorized people; design areas so delivery staff cannot reach the rest of the building; secure external doors while inner doors are open; inspect incoming items for explosives, chemicals or other hazards before moving them; register deliveries under asset management (5.9, 7.10); separate incoming and outgoing goods where possible; and check for tampering in transit, reporting any at once to security.
Source: ISO/IEC 27002:2022, 7.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Electronic access control logs or physical logbooks, protected and monitored · Physical access / facilities
- Access control system configuration for secure areas, such as card plus PIN or biometrics and double doors · Physical access / facilities
- Visitor logs recording identity checks, arrival and departure, purpose and escort · Physical access / facilities
periodic reviewEvidence produced at each review
- Physical access rights records with provisioning, periodic review and revocation evidence · Physical access / facilities
- Key management records including key registers and annual key audits · Key management / PKI
- Delivery area procedures and records of inspection, registration and tamper checks on incoming items · Physical access / facilities
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Access badges of leavers remain active
- Visitors move around unescorted and without visible badges
- Emergency exits can be opened from outside or are not alarmed
- Delivery staff can walk from the loading bay into office areas
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.1 Physical security perimeters · 7.3 Securing offices, rooms and facilities