Control A.7.2Physical entry
Secure areas must be protected by appropriate entry controls and access points.
Where A.7.1 defines the boundary, this controls passage through it: who may enter, how that is authorised, how it is verified, and how it is recorded.
The requirement reaches visitors, contractors and deliveries as well as staff, and those are where the weaknesses are. A visitor signed in and then unescorted is inside the perimeter with none of the controls that apply to the people around them.
Tailgating is the failure every organisation knows about and few address, because addressing it requires people to challenge colleagues — a behaviour that depends on the culture built by A.6.3’s training and on management making it acceptable.
Entry records matter for the same reason logs do under A.8.15: after an event, the question of who was present is answerable only if something recorded it at the time.
How to put this in place
Access to premises and sensitive rooms should be limited to authorised people, with a trail. A project that skips this finds leavers' badges still working and visitors unescorted.
- Decide who may enter which areas and how visitors and deliveries are handled.
- Set up badges or keys, a visitor sign-in with escort and a separate delivery point.
- Remove access on the last day and match removals to the leavers list.
- Review access lists at planned intervals, for example every six months.
- Keep entry logs and visitor records for a set period.
Evidence an auditor usually looks for: access system reports, visitor logs, leaver badge removals matched to HR dates, and access list reviews.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.