If we work from a shared building or a rented office, which physical controls do we still need under ISO 27001?

Start

We rent or share our premises and must decide our physical controls

The physical controls cover perimeters, entry, rooms, monitoring, equipment and disposal. The Library marks most as almost always applying, and a few as depending on scope. In a shared or rented building the decision is which you run yourself and which the operator must show you.

• Then: List every place information is handled, shared floors and homes too

Step

List every place information is handled, shared floors and homes too

The first physical control asks you to identify the premises and areas in scope, including shared building areas and any equipment room. For premises you rely on but do not run, such as a landlord or a cloud provider, record whose control applies. Homes are covered by the remote working question.

• Then: Does a landlord or coworking operator control entry to the building?

Decision

Does a landlord or coworking operator control entry to the building?

In a shared building you do not control the front door, the lifts or the shared areas. Ignoring shared building areas is the Library's named mistake. If you do not know who controls entry, answer yes.

• Yes, or not known: Ask the operator in writing how entry, cameras, fire and power work
• No: Is there equipment or paper to lock away, such as network gear?

Step

Ask the operator in writing how entry, cameras, fire and power work

Ask what controls the operator runs, who holds keys and passes, how visitors reach your floor, whether there is a recent assurance report or certificate, and how they tell tenants of incidents. A landlord may say its systems are tested; ask for the record. Assuming it is the Library's named mistake.

• Then: Does what the operator shows cover the area you use?

Decision

Does what the operator shows cover the area you use?

A certificate or report must cover the building and the controls you rely on, not another site or another service. If the operator gives only a statement, or the scope is unclear, answer no.

• Yes: Is there equipment or paper to lock away, such as network gear?
• No, or not known: Add your own controls inside your space, and record the residual risk

Step

Add your own controls inside your space, and record the residual risk

Lock your suite or a room, put equipment in a locked cabinet, control keys and passes yourself, and keep sensitive paper in lockable storage. Record what the operator could not show and who accepted the remaining risk.

• Then: Is there equipment or paper to lock away, such as network gear?

Decision

Is there equipment or paper to lock away, such as network gear?

Equipment rooms used as storerooms and left open are the Library's named mistake, as are network switches in open corridors and a server under a desk. If you keep any equipment on site, answer yes.

• Yes, or not known: Use a locked room or cabinet, with a short list of key holders
• No: Record that no secure area is needed, and why

Step

Use a locked room or cabinet, with a short list of key holders

Choose the smallest space that works. Keep a key or pass list, review it at least every 6 months as the Library suggests and remove leavers at once. Avoid signs that say what is inside, and keep screens out of view from corridors and windows.

• Then: Do visitors, contractors or deliveries come into the space you use?

Step

Record that no secure area is needed, and why

If all systems are cloud-hosted and staff carry only laptops, the Statement of Applicability can say that the controls for your own equipment rooms do not apply, with the reason, while controls delivered by a provider stay applicable. Keep the controls for entry, clear desk, off-premises equipment and disposal.

• Then: Do visitors, contractors or deliveries come into the space you use?

Decision

Do visitors, contractors or deliveries come into the space you use?

Visitors left unescorted and tailgating accepted as normal are the Library's named mistakes. Even a small suite needs a simple rule. If anyone outside your staff enters, answer yes.

• Yes, or not known: Set a visitor routine: sign in, wear a badge, be escorted
• No: Set clear desk and clear screen rules that are enforced and checked

Step

Set a visitor routine: sign in, wear a badge, be escorted

Keep the sign-in record and review it. Keep deliveries away from the equipment and the papers. Tell reception or the operator what your rule is, since they may be the ones to apply it.

• Then: Set clear desk and clear screen rules that are enforced and checked

Step

Set clear desk and clear screen rules that are enforced and checked

Set the screen lock to a few minutes automatically, clear Confidential paper at the end of the day and collect printouts promptly. A policy with no checks, and a lock set to 60 minutes or not at all, are the Library's named mistakes. Do a short walk-round.

• Then: Do devices leave the premises, go for repair or get disposed of?

Decision

Do devices leave the premises, go for repair or get disposed of?

Lost laptops, unencrypted drives sent for repair and devices given away without a wipe are the Library's named mistakes. If you have a stock of old devices or send any for repair, answer yes.

• Yes, or not known: Encrypt portable devices; wipe or destroy old ones; keep certificates
• No: Do you control premises with sensitive equipment worth watching?

Step

Encrypt portable devices; wipe or destroy old ones; keep certificates

Encrypt every portable device and manage it so it can be locked or wiped. Remove or protect data before repair. Wipe or destroy storage before disposal or reuse, get certificates that list serial numbers and update the inventory.

• Then: Do you control premises with sensitive equipment worth watching?

Decision

Do you control premises with sensitive equipment worth watching?

Alarms and cameras help only where there is something to protect and someone to respond. Cameras nobody reviews and broken for months are the Library's named mistake. Cameras bring privacy duties. If the operator already watches the entrances and you keep nothing sensitive, answer no and record that you rely on the operator.

• Yes: Use alarm or cameras at entrances; name who responds; set retention
• No: Are you excluding a physical control because nothing needs it?

Step

Use alarm or cameras at entrances; name who responds; set retention

Check they work, decide who responds to an alarm, and keep footage for a set period within privacy law. The Library gives 30 calendar days as an example. Tell staff and visitors about the cameras.

• Then: Are you excluding a physical control because nothing needs it?

Decision

Are you excluding a physical control because nothing needs it?

Exclusions with only 'not relevant' as the reason are what auditors reject. A control that a landlord or provider runs for you stays applicable and is marked as delivered by them; exclude only a control for an activity or equipment you do not have in scope. Homes and shared spaces are still places information is handled. If you intend to exclude a physical control, answer yes.

• Yes: Write the reason in the Statement of Applicability for each one
• No: Walk the site as an auditor would; ask a colleague to find the rules

Step

Write the reason in the Statement of Applicability for each one

For each excluded control state what you checked, such as 'no servers or network equipment are kept on our premises'. Controls that a provider's premises deliver for you are not excluded: record them as delivered by the supplier, as the cloud providers question explains. Keep the others.

• Then: Walk the site as an auditor would; ask a colleague to find the rules

Step

Walk the site as an auditor would; ask a colleague to find the rules

Look at entry, the secure space, screens, cabinets and paper left out, and check the operator evidence. Ask a staff member what to do with a visitor or a lost pass. Record what you find.

• Then: Did the walk-through find a gap?

Decision

Did the walk-through find a gap?

Anything open, unlabelled or unknown to staff is a gap. If you did not walk through, answer yes.

• Yes, or not known: Fix them, update the record, then walk through again
• No: Physical controls decided for the premises, shared or rented

Step

Fix them, update the record, then walk through again

Correct the gap, brief the person involved and walk through again after the change. Repeat until the walk-through finds nothing.

• Then: Walk the site as an auditor would; ask a colleague to find the rules (back to an earlier step)

Outcome

Physical controls decided for the premises, shared or rented

Keep the site list, the operator evidence, the walk-through record and the Statement of Applicability reasons. Do not claim a control the operator runs as your own, and do not describe a landlord's statement as evidence of what you rely on.