ISO 27001 A.7.2: Control entry to secure areas

What A.7.2 requires in practice

Annex A control 7.2 asks that secure areas are protected by suitable entry controls and access points. The control covers everyone and everything that crosses the boundary: staff, regular suppliers, visitors and deliveries. Several ideas sit inside it. Entry should depend on an authorised purpose rather than on simply having a badge or an invitation. Keys, cards and codes need controlled issue, return and action when lost. Visitors need identification, a host and an appropriate level of supervision. Delivery points should let goods in without giving delivery staff a route to sensitive areas. The outputs are rules for who may enter which area, working entry mechanisms, and records showing that entry decisions are made and reviewed. The standard does not require biometric readers, a specific visitor system or any named technology; the controls must suit the site and its risks.

Separate identity, permission and the entry decision

Knowing who someone is does not establish where they may go. Define who can approve access to each protected area, what business need supports it and how the decision reaches the person or system controlling entry. A receptionist should not have to infer technical-room access from the fact that a visitor has an appointment with someone in the building.

For staff and regular suppliers, connect permissions with joining, role changes and departure. Consider time-limited or area-limited access where appropriate. Physical keys need the same management attention as electronic credentials: ownership, authorised issue, return and action when a key is missing. A record of issued keys is useful only if it reflects the keys still in circulation.

Design visitor and delivery handling around real journeys

Decide how a visitor's identity and purpose are confirmed, who receives them and what supervision is appropriate. Give them relevant entry and emergency information without exposing unnecessary security detail. An exception to normal escort arrangements needs an accountable decision; familiarity with a returning visitor is not itself authorisation.

Deliveries create a different interface. Goods may need to enter while the delivery person has no reason to access workstations, records or processing rooms. Review the physical route, reception responsibility and handover. Inspection arrangements should suit the goods and risks, and any inspection of personal belongings must respect applicable legal and ethical requirements. Do not copy an intrusive practice into every site simply because another business uses it.

Why controlling physical entry matters to the business

Most physical breaches do not involve forced doors; they involve a plausible person being let in. A dependable entry process stops a valid invitation or a staff badge from turning into unlimited access. For the business this protects customer records, equipment and staff, and it limits the time spent investigating where a missing item went. It also gives clients confidence when they visit or review your premises. At audit, entry control is usually tested by observation: auditors watch how visitors are received, check who holds keys and ask about former staff. A site where the practice matches the stated rules rarely generates findings.

How to implement A.7.2

Design entry around the actual journeys people and goods take through your site. Keep the arrangements workable for busy reception staff, because a rule that slows every visitor excessively will be quietly bypassed. Involve the people who operate the door in designing it.

1. List the secure areas and decide who may approve access to each, and on what business grounds.
2. Connect access permissions to joining, role changes and leaving, so that rights follow the person's real position.
3. Set rules for keys, cards and codes, covering issue, return, loss and the update of any shared codes.
4. Define how visitors are identified, received, escorted and recorded, and who may authorise an exception.
5. Review delivery routes and handover points so that couriers do not pass through sensitive areas.
6. Train reception, security and host staff on the rules and on what to do when someone cannot be verified.
7. Review entry records and key lists on a regular basis and correct any mismatch with current staff and suppliers.

Illustrative BPO example: an engineer's recurring visits

Illustrative manufacturing example: temporary access that outlives the job

A hypothetical manufacturer gives a facilities contractor electronic access for a refurbishment. After completion, the contractor's credential still opens a room containing production records and network equipment. Procurement has closed the purchase order, but no one has communicated that the physical access should end.

The organisation links temporary permission to an owner and an end condition, then checks expiry in the access system. The review also examines whether another contractor requires replacement access for follow-up work. Evidence connects the authorised purpose, permitted area, actual expiry and any approved extension. The remedy is a working lifecycle, not merely adding another signature to the original request.

Test the decisions and exceptions

Useful checks include comparing a sample of active permissions with current roles, confirming that expired access no longer works through an authorised test, and following a visitor from approval to departure. Examine arrangements during shift changes, reception absence and emergency maintenance. A process that works only when one experienced person is present is vulnerable to ordinary staffing changes.

Entry records can support investigation and review, but they may contain personal information. Decide access, protection and retention based on purpose and applicable requirements. ISO 27001 does not supply one universal retention period for every visitor log. Avoid collecting information simply because a digital form makes additional fields easy to add.

Evidence and neighbouring controls

Common nonconformities with A.7.2

Auditors who observe entry practice tend to find the following. Many of these come from convenience overriding the rules, and are visible to an auditor within minutes of arriving at reception.

• Visitors admitted on a staff member's word with no identification or record.
• Former employees or suppliers whose cards or keys still work.
• Key registers that do not match the keys actually in circulation.
• Shared access codes that have not changed for years despite staff turnover.
• Delivery staff able to walk unaccompanied into working areas.