Control A.7.6Working in secure areas
Security measures for working in secure areas must be designed and implemented.
Having established a secure area under A.7.1 to A.7.3, this governs conduct inside it: who may work unsupervised, what may be taken in and out, whether recording devices are permitted, and how the area is treated when empty.
The control exists because physical entry controls address who gets in and not what happens next. A data centre, a card production facility, a trading floor or a room handling sensitive case material each need rules about activity, not only about access.
The measures most often specified and least often enforced concern devices. A prohibition on cameras that does not survive the arrival of phones is not a control; the organisations that make it work either provide somewhere to leave them or accept the risk explicitly rather than maintaining a rule that everybody breaks.
Unoccupied secure areas should be locked and, where the risk justifies it, checked.
How to put this in place
Protection can be undone by the people allowed inside, so secure areas need working rules, not only locks. Where no such areas exist in your scope, say so; where they do, rules must be real.
- Decide which areas count as secure, such as equipment rooms or restricted offices, and which exist only at providers.
- Set simple rules: who may work alone, whether photos and personal devices are allowed, and supervision of visitors and contractors.
- Post the rules at the entrance and brief everyone with access.
- Keep access lists short and review them.
- Record supervised third-party work.
Evidence an auditor usually looks for: the rules for each secure area, access lists, and supervision records for third-party work.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.