ISO 27001 A.7.3: Secure offices, rooms and facilities

What A.7.3 requires in practice

Annex A control 7.3 asks the organisation to design and put in place physical security for its offices, rooms and facilities. Where 7.1 and 7.2 deal with boundaries and entry, this control looks at the spaces themselves: how a room is laid out, where it is, what is visible or audible from outside, and how it is used. A meeting room next to a public waiting area, a payroll office with a window onto a corridor, or a shared equipment cupboard all raise different questions. The control expects the design to reflect the activity in the space and the information involved. The outputs are decisions about the location and arrangement of sensitive activities, measures that deal with the identified exposure, and a way of confirming they work. It does not require identical secure rooms in every organisation, and it does not set technical specifications.

Define the information activity before choosing the room

Identify what will happen in the space. A recruitment interview, a product-design discussion, a payroll-processing activity and equipment administration can expose different information through different routes. Consider paper, displays, conversations, whiteboards and devices, as well as the people permitted to use the room. A label such as “meeting room” does not explain the protection needed.

Then examine the surrounding environment. A room beside a public waiting area may need a different arrangement from one inside a restricted staff zone. Decide whether sensitive activities should be relocated, whether visibility needs to change, or whether additional physical and operating measures are appropriate. The strongest choice may be assigning the activity to a better location before expensive modifications are considered.

Design for both normal use and interruptions

Review sightlines and the possibility of conversations being overheard. Practical options can include changed screen orientation, suitable visual screening or an alternative meeting location. Specialist assessment may be needed for particular facilities; an ordinary walkthrough cannot establish every technical protection property. Select measures for the actual risk, and confirm they do not create unacceptable safety or accessibility problems.

Information about sensitive facilities also deserves care. Public directories, booking descriptions or publicly accessible plans can reveal more than intended about where valuable information is held. This does not justify secrecy around emergency arrangements or denying authorised workers information they need. It calls for an informed decision about the audience and purpose of each disclosure.

Why secure offices and rooms matter to the business

Information leaks through ordinary spaces long before it leaks through technology: a whiteboard left uncleared, a conversation overheard through a thin partition, a screen visible from the street. Thoughtful design of rooms lets the organisation keep welcoming customers and candidates while protecting what matters. Sometimes the cheapest and strongest measure is moving an activity to a better location rather than building something new. Clients with sensitive work often inspect premises, and a sensible layout shows maturity. During audit, room-level protection is checked by walking through, so problems of visibility, overhearing and unattended material tend to be found quickly if they exist.

How to implement A.7.3

Decide what happens in each space before deciding how to protect it. Remember that expert judgment may be needed for particular rooms, such as those used for sensitive calls. An ordinary walkthrough by the security lead will not settle every question, so say where specialist input was used.

1. List the sensitive activities, such as interviews, payroll processing, design reviews and equipment administration, and where they currently take place.
2. Look at each space from the outside: what can be seen, heard or reached from corridors, windows and neighbouring rooms.
3. Consider moving the activity before modifying the room, since relocation is often simpler and cheaper.
4. Choose proportionate measures, such as screen orientation, screening of glass or sound-conscious room allocation.
5. Check that the chosen measures do not conflict with safe evacuation, accessibility or building rules.
6. Look at what the organisation publishes about its premises, including booking descriptions and plans, and remove unnecessary detail.
7. Review rooms after moves, refits or changes in activity and record what was decided.

Illustrative software example: client reviews beside reception

Illustrative manufacturing example: production plans in a mixed-use office

A hypothetical manufacturer uses one office for dispatch conversations and discussion of commercially sensitive production plans. Drivers and external maintenance personnel regularly enter for legitimate reasons. Managers initially propose a stronger door lock, but this would not separate the incompatible activities while the office is open.

The site relocates the dispatch handover to a suitable public-facing point and reserves the internal room for authorised work. Facilities and operations check that the new route remains practical, including during busy periods. Later observation verifies that staff have not resumed the old handover because the alternative is inconvenient. The chosen design changes the exposure, while operating checks help keep the design effective.

Keep the design current when use changes

Property projects often pass through teams that do not own information security. Include a security review when rooms change purpose, partitions move, public areas expand or another tenant occupies adjacent space. A previously acceptable room may become unsuitable for a new activity even if no physical component has failed.

For leased sites, clarify which alterations need approval and which measures the organisation can maintain itself. A temporary workaround should have a responsible owner and review point. If the preferred design cannot be introduced immediately, assess interim measures and the remaining risk through the ISMS instead of describing an unresolved intention as an implemented control.

What evidence should a reviewer examine?

Common nonconformities with A.7.3

Findings generally arise when rooms are designed for convenience only. They are usually easy to see on a walkthrough, and often reflect decisions made when the space was first allocated.

• Sensitive discussions held in rooms beside public areas with thin partitions.
• Screens that are visible from windows or walkways.
• Whiteboards and flip charts carrying confidential content after meetings.
• Meeting rooms available to anyone without any consideration of the information discussed.
• Public floor plans or booking details that reveal where valuable equipment is kept.