Control A.7.1Physical security perimeters
Security perimeters must be defined and used to protect areas that contain information and other associated assets.
The starting point of the physical family: deciding where the boundaries are before deciding how to control what crosses them. A perimeter may be a building, a floor, a room or a cage in a shared facility, and the protection it needs follows from what is inside and from the classification scheme in A.5.12.
The control asks for perimeters to be defined, which is more than assumed. Organisations frequently treat the office door as the boundary and hold sensitive material well inside it with nothing further between, or inherit a perimeter from a landlord and never establish what it actually provides.
Shared and serviced offices are where this is hardest and least examined. A perimeter that other tenants, cleaners and building staff routinely cross is a perimeter in name, and the honest response is to define a real one further in.
How to put this in place
Physical protection needs a boundary before it can be designed. The project must list the premises and areas that hold in-scope information and say who controls each, including shared buildings and provider sites.
- List every site and area in scope, including shared floors, equipment rooms and home offices where relevant.
- Define the boundary of each and the protection it needs, based on the risks.
- Record who controls areas you do not run, such as a landlord or cloud provider, and ask for their assurance.
- Mark the boundaries physically and on a site plan.
- Review when you move, expand or change landlord.
Evidence an auditor usually looks for: a site list with defined perimeters, a walk-through of the boundaries, and landlord or provider assurance for areas outside your control.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.