ISO 27001 physical controls: A.7.1–A.7.14
The 14 physical controls in Annex A section 7 address protection of premises, equipment and media against relevant physical and environmental exposures. Physical security remains relevant when technology is outsourced: the organisation may still operate offices, use devices and records, and depend on provider facilities.
Understand the boundary and the lifecycle
Perimeters, entry and protection of rooms establish related but distinct layers. Physical monitoring supports detection and response rather than replacing a boundary. Environmental threats and supporting utilities affect availability and integrity as well as immediate safety considerations. Working practices can influence exposure even where the building’s access system is strong.
Equipment needs consideration while installed, used away from premises, maintained, reused or disposed of. Media handling, clear-desk arrangements and cabling have their own purposes. Follow the individual guides to identify the decisions relevant to your actual information and locations.
Illustrative examples
A construction business uses a temporary project office with shared access. It considers where sensitive drawings and devices are kept, how visitors are handled and how information is removed or retained when the site closes. A corporate policy written for a permanent head office would not resolve all of those conditions.
A BPO operates from leased premises. It evaluates building access responsibilities, its own restricted areas and provider arrangements that support continuity. A lease agreement or a building-security brochure is reviewed for relevance rather than treated as conclusive evidence of all required outcomes.
Evidence that tests the arrangement
Useful evidence includes appropriate access decisions, inspections, tested response routes, maintenance or disposal records and assurance about external facilities. Evaluate whether records relate to the actual scope and period. A camera image does not alone show that monitoring is reviewed or that relevant events lead to action.
Consider privacy, legal and employment obligations when monitoring people or premises. Technical capability does not establish legal permission. The control guides focus on original security implementation advice and direct readers to confirm applicable obligations through appropriate specialists.
Individual controls in this theme
A.7.1 · Define physical security perimeters
A physical security perimeter establishes where protection changes and which assets belong inside that boundary. This guide explains layered zones, shared-building responsibilities and checks that reveal weak interfaces. IT and construction examples connect the boundary decision with entry arrangements, building changes and evidence of effective protection, without prescribing one type of barrier.
A.7.2 · Control entry to secure areas
Physical entry control connects a person's legitimate purpose with permission to enter a particular area. This guide follows staff permissions, visitor handling, deliveries and shared-premises interfaces. BPO and manufacturing examples show how to prevent an approved visit becoming unrestricted access and how to test whether changes and expiry actually reach the entry system.
A.7.3 · Secure offices, rooms and facilities
Secure-room design considers what can be reached, seen or heard where information is handled. This guide connects room purpose, layout, neighbouring areas and changes of use. Software and manufacturing examples explain how to reduce unintended disclosure through practical design decisions and verify that the finished arrangement protects the actual activity.
A.7.4 · Make physical security monitoring effective
Physical monitoring needs more than installed cameras or alarms: coverage must continue and an actionable signal must reach someone able to respond. This guide follows detection, system protection and response assurance. Construction and BPO examples show how to test monitoring arrangements without confusing footage collection with effective security or unrestricted surveillance.
A.7.5 · Protect against physical and environmental threats
Physical and environmental events can damage information or interrupt services even when access controls work correctly. This guide explains how to connect location-specific threats with suitable safeguards, responsible owners and review triggers. IT and manufacturing illustrations follow water exposure and adjacent works into practical decisions, without treating generic advice as a technical design.
A.7.6 · Control work inside secure areas
Permission to enter a secure area does not authorise every activity inside it. This guide examines work boundaries, supervision, recording devices and information exposure after admission. Manufacturing and software examples show how to agree a task, manage exceptions and confirm the area is left protected, without imposing a universal two-person rule.
A.7.7 · Make clear desk and screen rules workable
Clear desk and clear screen practices protect information when attention moves elsewhere, work is shared or a space is vacated. This guide covers papers, media, printing, displays and presentation interruptions. BPO and construction examples show how usable storage and clear responsibility support reliable behaviour without mistaking visual tidiness for information security.
A.7.8 · Site and protect equipment appropriately
Equipment protection begins with choosing a location that suits its use, sensitivity and operating conditions. This guide examines exposure to observation, interference, damage and unsuitable surroundings. Manufacturing and IT examples show how a convenient installation point can create risk, and how relocation or suitable protection should be checked after implementation.
A.7.9 · Protect assets away from your premises
Assets taken outside company premises need protection suited to travel, temporary use and changing custody. This guide explains authorisation, minimum information, handovers and loss reporting. Construction and software examples follow equipment through field work and a client demonstration, showing why an asset list alone cannot establish that off-site information remains protected.
A.7.10 · Manage storage media through its lifecycle
Storage media needs consistent handling from first use through transport, retention, reuse and disposal. This guide covers both digital media and paper, connecting classification with practical choices. Manufacturing and BPO examples examine controlled transfer and disposal custody, while distinguishing readable retained information from a box or drive that merely still exists.
A.7.11 · Protect the utilities your information services need
Power, cooling and communications can determine whether an information service remains available, even when its applications are secure. This guide explains dependency mapping, capacity, fault response and assurance from building providers. BPO and software examples show why backup power or a second connection must be evaluated as part of a complete working service.
A.7.12 · Protect cabling and its connection points
Cabling security protects the physical paths carrying power and information, including the connection points that staff and suppliers can reach. This guide examines routing, identification, shared infrastructure and controlled changes. Construction and IT examples show how an undocumented route or open patch area can undermine otherwise sound network and continuity arrangements.
A.7.13 · Maintain equipment without losing control
Maintenance protects availability, integrity and confidentiality when equipment is serviced, repaired or returned to operation. This guide connects planned upkeep with authorised access, off-site repair and verification. BPO and manufacturing examples show how a legitimate service activity can expose information or leave a changed system behind unless responsibility continues through completion.
A.7.14 · Verify secure equipment disposal and reuse
Equipment leaving service can still contain sensitive information, licensed software and details of the organisation's systems. This guide follows identification, treatment, verification and authorised release. IT and construction examples explain why a factory reset, a recycling collection or internal reassignment needs evidence appropriate to the actual equipment and information involved.
Why physical controls matter to the business
Information security is often discussed as if it lived entirely in networks and software, yet every system sits in a building, on a desk or in someone's bag. Physical controls address the ways information and equipment can be reached, observed, damaged or lost in the real world: an unlocked room, a stolen laptop, a flooded cupboard, a failed power supply. For customers, visible physical discipline is often the first impression of how seriously an organisation treats their data, and it features in many supplier assessments. For the business, the controls protect availability as well as confidentiality, because a physical event can stop operations as surely as an attack. Applying the theme sensibly means choosing measures that fit each site's risks rather than copying one design everywhere.
Frequently asked questions
Can a fully cloud-based company exclude every physical control?
Not automatically. Consider offices, devices, media, remote working and provider dependencies, then justify relevant control decisions through risk treatment.
Does a landlord’s access system cover our responsibilities?
It may provide part of the arrangement. Clarify what the landlord controls and what remains your responsibility, including internal areas and working practices.
Is installing CCTV sufficient physical-security evidence?
No. Consider the purpose, coverage, appropriate use, review and response, alongside other necessary arrangements and applicable legal and privacy obligations.
Assess the places and equipment your information depends on
Review your offices, project sites, shared facilities, equipment and media with Sterling. An agreed assessment can clarify physical boundaries, provider responsibilities and proportionate protection, then identify the operating checks needed to show those arrangements work. Assess whether Effivity ISO & GRC automation software can support your agreed workflow for physical-control actions, ownership and follow-up evidence. Arrange a focused consultation.
Develop control-owner understanding through Sterling Academy’s 93 Annex A Controls training. Training and consulting support implementation; independent certification bodies decide certification outcomes.