ISO 27001 A.7.6: Control work inside secure areas

What A.7.6 requires in practice

Annex A control 7.6 asks the organisation to design and put in place security measures for working inside secure areas. Getting through the door is only the start: an authorised person can still expose information, disturb equipment or carry out an unapproved activity once inside. The control therefore concerns what happens in the area. Parts include defining what work is permitted and what needs further permission, explaining the rules before the work starts, deciding whether supervision is needed, controlling devices such as phones and cameras, and ensuring the area is left in a proper state. It also considers unusual conditions, like vacant rooms and tasks that overrun. The outputs are working rules for the area that people understand, supervision where warranted, and records showing that work was carried out as approved. The standard does not prescribe a particular supervision model or device ban.

Describe permitted work and its boundaries

Start with why the area is protected and what activities take place there. A records room, development laboratory and network room expose different assets. Identify which tasks a person is authorised to perform and which changes require further permission. Someone maintaining air conditioning does not automatically need access to the information processed nearby.

Make relevant rules understandable before work starts. Explain permitted equipment, information handling, escalation and how the area should be left. Avoid circulating sensitive details to people who do not need them, while ensuring authorised workers can obtain the instructions and emergency information necessary for their task.

Choose supervision and device rules deliberately

Supervision may be appropriate where an external worker or unusual activity creates exposure. Decide what the supervisor needs to observe and whether they have enough competence and availability to do so. Naming an escort who immediately returns to unrelated work does not establish effective oversight.

Recording devices require particular thought. A photograph needed for a legitimate maintenance report could also capture customer information, screen contents or facility details. An authorised exception should define purpose, permitted content, storage and onward sharing. Blanket permission because a device belongs to a supplier is weak control; a blanket ban that staff routinely bypass is also unreliable.

Why controlling work inside secure areas matters to the business

Secure areas often hold the organisation's most sensitive material, and many incidents involve people who were properly admitted. A contractor servicing equipment may see screens, a visitor may photograph a prototype, or an engineer may change something that was not part of the job. Rules for working in the area keep access tied to purpose and protect other clients' and projects' information. Customers who share confidential material expect it to be shielded from incidental exposure. During audit, the question is whether the activity inside matched what was approved, so clear boundaries around work reduce findings and arguments after an incident.

How to implement A.7.6

Describe the work, not just the door, when setting up a secure area. Involve the people who actually enter these areas when drafting rules, since they know which instructions are practical. Keep the rules short and visible at the entrance to the area.

1. Record why each area is protected, what happens there and which tasks different groups of people may perform.
2. Make the rules available before work starts, covering permitted equipment, information handling and how to leave the area.
3. Decide when supervision is needed and confirm the supervisor has the competence and time to observe effectively.
4. Set rules for phones, cameras and other recording devices, with a process for authorised exceptions.
5. Prepare the area before external work, for example by clearing screens and removing material that is unrelated.
6. Define how unoccupied areas are checked and how overrunning or emergency work is authorised.
7. Carry out completion checks that compare the work done with the work approved.

Evidence an auditor expects for A.7.6

An auditor will look for signs that the activity inside the area is controlled, not only the entry. Typical evidence is a mixture of records and observation.

• Work orders or access approvals that state the task, the area and the permitted equipment.
• Records of supervision or escort arrangements for external workers.
• Observation of how a visitor or contractor is managed once inside the area.
• Interview with the area owner about recording-device rules and exceptions.
• Completion checks showing the area was left in its proper condition.

Common nonconformities with A.7.6

Findings usually appear where entry is controlled but activity is not. Most arise because entry approval was treated as the end of the control rather than the beginning, and are easy to confirm by observation.

• Contractors left alone in a secure area with no explanation of what they may touch.
• Sensitive screens visible during maintenance because nobody prepared the room.
• Personal phones and cameras permitted in the area with no rules or exceptions process.
• An escort named on paper who leaves the visitor to carry on unobserved.
• No check on the condition of the area after work is completed.

Illustrative manufacturing example: maintenance inside a protected room

Illustrative software example: a client demonstration in a secure lab

A fictional software company invites a client to observe a prototype in a restricted laboratory. The client has a legitimate reason to attend, but unrelated prototypes and development notes belong to other projects. A general confidentiality agreement does not determine which material should be visible during the visit.

The host prepares the demonstration area, limits the session to the agreed activity and discusses recording restrictions beforehand. An approved test device is used rather than allowing an unreviewed personal device to connect to development equipment. After the visit, the host checks the area and records any authorised materials shared. The lesson concerns controlled activity within the area, even when every participant was correctly admitted.

Plan for unusual and unattended conditions

Secure areas can be exposed when normal activity stops. Establish how vacant rooms are protected and how relevant checks occur. Consider temporary handovers, emergency maintenance and a task that continues beyond its original schedule. The process should allow an accountable decision when circumstances change rather than leaving workers to interpret an expired approval.

Safety and security responsibilities need to remain compatible. The guidance to consider supervised work is not a universal instruction that every task requires two people. Determine suitable arrangements using the activity, hazards, security exposure and applicable obligations. People must still be able to obtain assistance and follow appropriate emergency procedures.

Demonstrate the rule in use

Evidence can include task authorisation, relevant briefings, approved device exceptions, supervision arrangements and completion checks. These records are possible implementation methods. The required ISMS information should show the selected control and its operation, but ISO 27001 does not prescribe a form named “secure-area work permit” for every task.

A useful authorised review follows one actual activity from preparation to completion. Ask the person responsible what would happen if the contractor needed extra time, a different tool or additional information. Check whether the answer matches both the written arrangement and actual authority. Repeated verbal exceptions suggest the rules or the work process need improvement.

Related controls cover physical entry, equipment maintenance and endpoint protection. Operational planning connects them. Common mistakes include assuming that a badge approves every task, overlooking cameras on ordinary devices and treating supervision as a name on a schedule rather than an actual responsibility.