A.7.1 Physical security perimeters
Defining and using security perimeters around areas that hold information and associated assets: perimeter design, strength in proportion to risk, and how an auditor walks and verifies the boundary.
Physical controls
Annex A theme 7: physical and environmental security for sites, secure areas, equipment, storage media and supporting utilities, from perimeters and entry to monitoring and disposal.
A.7.2 Physical entry
Entry controls and access points for secure areas, including visitor handling and delivery and loading areas, plus the access logs and authorization records an auditor reviews.
A.7.3 Securing offices, rooms and facilities
Physical security for offices, rooms and facilities inside the perimeter, such as locks, discreet signage and keeping sensitive activities and information out of public view.
A.7.4 Physical security monitoring
Continuous monitoring of premises for unauthorized physical access through guards, intruder alarms and video surveillance, new in the 2022 revision, and the monitoring records an auditor expects.
A.7.5 Protecting against physical and environmental threats
Protection of infrastructure against natural disasters and other intentional or unintentional physical threats such as fire, flood and unrest, based on a risk assessment of each site.
A.7.6 Working in secure areas
Rules for working inside secure areas: who may enter and when, supervision, limits on photographic and recording devices and unsupervised work, and how the rules are communicated and checked.
A.7.7 Clear desk and clear screen
Clear desk rules for papers and removable storage media and clear screen rules for devices: automatic screen locks, printer and whiteboard handling, and how auditors spot-check desks and screens.
A.7.8 Equipment siting and protection
Siting and protecting equipment to reduce risks from physical and environmental threats and unauthorized access, including environmental conditions, food and drink rules and shielding against information leakage.
A.7.9 Security of assets off-premises
Protecting devices and other assets used or stored off-site, such as laptops and media taken home or on travel, with custody, transport and loss-reporting rules.
A.7.10 Storage media
Managing storage media through acquisition, use, transport and disposal according to classification and handling rules, covering removable media, media in transit and secure media disposal.
A.7.11 Supporting utilities
Protecting information processing facilities from failures in supporting utilities such as electricity, telecommunications, water supply and HVAC, with capacity, redundancy, alarms and regular testing.
A.7.12 Cabling security
Protecting power and data cabling from interception, interference and damage: routing, conduits, separating power from communications cables, and periodic inspection.
A.7.13 Equipment maintenance
Maintaining equipment correctly to keep information available, intact and confidential: maintenance schedules, authorized maintainers, supervision of outside personnel and maintenance records.
A.7.14 Secure disposal or re-use of equipment
Verifying that equipment containing storage media is free of sensitive data and licensed software before disposal or re-use, with sanitization methods and disposal records.
