Control A.7.3Securing offices, rooms and facilities
Physical security for offices, rooms and facilities must be designed and implemented.
The layer between the perimeter and the individual asset. It covers how spaces are arranged and protected — where sensitive functions sit relative to public access, what the walls and doors actually provide, whether directories and signage advertise where valuable things are, and how rooms are secured when unoccupied.
Design is the operative word: this is cheapest and most effective when a space is laid out, and expensive afterwards. It is also the control most often inherited rather than decided, because organisations move into space designed for someone else.
The specific arrangements worth deliberate thought are the ones where sensitive activity meets general access — a reception with a view of a screen, a meeting room shared with visitors, a post room, a server cupboard that is also where the cleaning supplies live. Each is a decision somebody made without making it.
How to put this in place
Some rooms hold more than others, such as HR, finance or equipment rooms. The project must decide which need extra protection so that casual access and overlooking are limited.
- Identify the rooms and offices that hold sensitive information or equipment.
- Decide the protection each needs: locks, restricted access lists, no signage that advertises contents.
- Fit the protection and keep a record of keys or access rights.
- Check that screens, whiteboards and documents cannot be seen from corridors or outside.
- Walk the sites periodically and fix what you find.
Evidence an auditor usually looks for: a site walk-through, lock and key records, room access lists, and no equipment rooms used as open storerooms.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.