ISO 27001 Information Security - Annex A 7 Physical Controls

This article on Annex A 7 Physical Controls is based on an extract from the Guide Book in the Qudos ISO 27001 InfoSec Toolkit - exclusively available as an integrated component of Qudos 3 software.

7.1 Physical security perimeters (11.1.1)

The purpose of this control is to prevent unauthorised access, damage or tampering with assets. To that end, Security perimeters must be defined and protected for areas that contain information assets.

7.2 Physical entry (11.1.2 / 11.1.6)

The intent here is to ensure that there is only authorized access to areas containing information.

7.3 Securing offices, rooms and facilities (11.1.3)

This control requires the design an implementation of physical security for those areas.

7.4 Physical security monitoring

This is a new control in ISO 27001:2022.

The requirement here is for continuous monitoring to be implemented to detect and deter intruders.

7.5 Protecting against external and environmental threats (11.1.4)

Protection needs to be implemented against both forces of nature and man-made threats (whether they be intentional or otherwise). Some of the typical examples to consider may include: Fire, Flood, Storm, and Power surges. Depending on the nature of your business and geography, this may include terrorist threats or more general criminal activity.

7.6 Working in secure areas (11.1.5)

Rules for working in secure areas need to be established. What is a secure area? Well, it's not clearly defined in the Terms and Definitions section of ISO 27001, or the Vocabulary and Overview standard, ISO 27000.
Where an organization has an on-premise server room, that is normally considered to be a secure area.

7.7 Clear desk and clear screen (11.2.9)

As the title suggests, the objective is prevent unauthorised access to information by maintaining a clear desk and a clear screen. There are some very simple steps that can be taken here. However, there can be some costs incurred in facilitating the implementation of the policy.

The standard requires that rules are defined, and these are typically expressed in a 'Clear desk and clear screen policy'.

7.8 Equipment siting and protection (11.2.1)

The objective here is to prevent loss, damage, theft or compromise of assets and interruption to operations. Such provisions may include:

Equipment (such as computers, printers, or photocopiers) that may display sensitive information should be located so as to avoid that
information being viewed by an unauthorised person.

7.9 Security of assets off-premises (11.2.6)

This control requires the protection of any information devices that used off-premise. That includes corporate-owned devices and those belonging to workers but used for business purposes. That last category is often referred to as BYOD of Bring-Your-Own-Device. Some organizations choose to have a BYOD policy or include it in their User Endpoint Device or Mobile Device policy.

7.10 Storage media (8.3.1 to 8.3.3 / 11.2.5)

Unauthorized disclosure, modification, removal or destruction of information stored on media should be prevented. This means that procedures should be developed to manage any removable media including control of its transportation and disposal.

Removable media (such as external hard drives, DVDs etc.) should be managed in accordance with the information classification scheme developed for Annex A control 5.12.

Media shall be disposed of securely when no longer required. That applies to removable media such as that as described above, but also to another very common type of media...paper!

7.11 Supporting utilities (11.2.2)

These may include power, telecoms, air conditioning etc. They need to have adequate capacity and redundancy as appropriate, be regularly checked, properly maintained, and monitored as applicable. It may be necessary for them to have error detection with appropriate alarm indications.

7.12 Cabling security (11.2.3)

Power and data cables should be protected against interception, interference, or damage. The routing of network cabling through insecure areas should be avoided. Access to wiring cabinets etc. should be suitably protected and restricted to authorised personnel.

7.13 Equipment maintenance (11.2.4)

All equipment should be maintained in accordance with the relevant manufacturer's instructions in order to ensure continued functionality and
maintain warranty.

7.14 Secure disposal or reuse of equipment (11.2.7)

A known area of information security failure can occur when equipment containing sensitive information is carelessly disposed of or re-purposed.
Appropriate controls should be implemented to ensure that disposal or reuse of equipment does not lead to a security breach.

This article on Annex A 7 Physical Controls is based on an extract from the Guide Book in the Qudos ISO 27001 InfoSec Toolkit - exclusively available as an integrated component of Qudos 3 software.