ISO 27001 A.7.1: Define physical security perimeters
A physical security perimeter makes it clear where access and protection need to change. For an organisation handling confidential client records, production information or critical infrastructure, the useful question is not simply whether the building has a lock. It is whether the boundary protects the particular information and equipment inside it, including when normal working arrangements change.
What A.7.1 requires in practice
Annex A control 7.1 asks the organisation to define security perimeters and to use them to protect areas that hold information or other assets connected to it. A perimeter is any boundary that separates a protected space from a less protected one, such as a building edge, a locked floor, a cage or a room. The parts of the requirement are straightforward: decide where the boundaries are, base them on what needs protecting, and make them actually work as boundaries. This usually means thinking in layers, for example reception, general working space and a restricted equipment room. The control also covers sites shared with other occupants or managed by a landlord, where the organisation must understand which part of the boundary it controls. The outputs are a clear picture of the protected areas and their boundaries, an owner for each, and evidence that the boundary is effective in practice. The standard does not prescribe particular walls, locks or zones.
Draw the boundary around what needs protection
Begin with the assets, activities and consequences. A room holding original customer contracts, a network equipment cupboard and a public training room do not necessarily need the same perimeter. Determine who could reach each area through normal business activity, shared facilities, maintenance or deliveries. Identify where unauthorised presence could expose information, interrupt services or permit interference.
A layered approach may separate the public reception area, general staff accommodation and a restricted equipment room. These are implementation choices, not prescribed zone names. Each boundary should have a clear purpose and a responsible owner. Avoid drawing a secure zone on a plan while leaving its connecting corridor or neighbouring tenancy outside the analysis.
Why defined physical perimeters matter to the business
A boundary nobody has defined is a boundary nobody maintains. When an organisation knows exactly which rooms and floors hold its valuable records and equipment, it can spend security money where it counts and avoid expensive measures where they do not. Clear perimeters also make everyday life easier: staff, visitors and contractors know where they may go. Customers who store confidential material with you will often ask about site boundaries, and a precise answer builds confidence. At audit, an organisation that can explain why each boundary exists, and show it has been checked, typically avoids findings about uncontrolled areas and shared-building assumptions.
How to implement A.7.1
Work from the assets outwards, so that each boundary has a reason. Keep a simple plan or description of each layer so that a new facilities owner can understand the intent without a long handover. Use plain language rather than drawing conventions that only one person understands.
- Identify the areas that hold or process sensitive information or critical equipment, including cupboards and storage rooms easily overlooked.
- Walk each site and note who can reach those areas through normal activity, deliveries, maintenance and shared facilities.
- Decide how many layers of boundary are sensible for each area and describe the purpose of each one.
- Assign an owner to every perimeter who is responsible for its upkeep and for reporting weaknesses.
- Inspect the whole boundary, including windows, ceilings, service openings and adjoining tenancies, not only the main door.
- Agree with landlords or building managers which parts of the protection they supply and which remain yours.
- Recheck the perimeters after building works, moves or changes in use, and keep a note of what was reviewed.
Illustrative construction example: a changing project office
A hypothetical contractor stores tender information and client drawings in a temporary project office. During a site reconfiguration, a delivery route is moved alongside that office and an internal partition is altered. The old security plan no longer represents the environment in which the records are used.
The project reviews the perimeter before the revised route opens, relocates publicly accessible activities and checks the protection of the record area. It updates the responsible contacts and explains the new boundary to site personnel. A later inspection compares the approved arrangement with actual doors, partitions and access routes. The lesson is that temporary premises need a maintained boundary, not merely a signed drawing from mobilisation.
Evidence that demonstrates the perimeter works
A useful review follows the decision from risk to physical implementation. Supporting evidence can include controlled site plans, responsibility agreements, alteration reviews, inspection results and resolved defects. These document names are optional. The ISMS needs sufficient controlled information to explain its selected controls and demonstrate that planned arrangements operate; sensitive security drawings also require appropriate access restrictions.
Tests should be authorised and proportionate. A supervised walkthrough can compare the plan with reality and follow legitimate staff, visitor and delivery routes. Check whether a building change, a vacant neighbouring unit or an out-of-hours arrangement has created a gap. Record what was examined and the resulting action rather than stating simply that “physical security passed”.
Common boundary mistakes
One frequent weakness is confusing a perimeter with entry authorisation. A sound boundary still needs rules for crossing it. Another is relying entirely on a landlord without confirming coverage. Also connect the design with physical monitoring and secure room design, so gaps are not left between separate owners.
Frequently asked questions
Does every office need a fence?
No. The appropriate boundary depends on the premises, assets and threats. A suitably designed internal boundary may be relevant; the control does not prescribe one universal construction solution.
Can one perimeter cover several security needs?
It can, but examine whether sensitive activities require additional internal separation. Using one boundary for convenience should not erase a meaningful difference in access or protection needs.
When should the perimeter be reviewed?
Use planned checks and relevant change triggers, such as alterations, occupancy changes or new critical equipment. The review frequency should reflect the risk and operating conditions rather than an invented ISO timetable.
Make the boundary decision part of your ISMS
Discuss physical security implementation with Sterling, including coordinated documentation, employee learning and agreed Effivity ISO & GRC automation software. The wider programme can include authorised vulnerability scanning and findings review within its agreed scope. Continued implementation support does not replace the independent certification body's decision. Enrol in ISO/IEC 27002 Information Security Controls to connect perimeter decisions with the wider control system, then return to the physical controls overview.