A.7.1 Physical security perimeters: requirements and evidence

What A.7.1 physical security perimeters asks for

A.7.1 asks the organization to define security perimeters around the areas that hold information and other associated assets, and to actually use those perimeters to protect them. In practice that means you must be able to name each boundary (a building, a floor, a data hall, a server room, a cage), explain where it runs, and show that it is enforced by physical barriers and access controls. The control is short, but an auditor will test whether the boundary exists on site, not only on the floor plan. The 2013 edition covered the same ground under A.11.1.1 Physical security perimeter, and the 2022 correspondence table in ISO/IEC 27002 traces the two, so older evidence can still be mapped to the current control.

The control does not prescribe a single strength for every boundary. The expectation is that the strength of each perimeter follows the risk to the assets inside it. A public lobby, a loading bay, an office floor and a room holding core network equipment carry different risks, so they warrant different barriers, such as solid walls and doors on a card reader for the most sensitive space, and a managed reception desk for the lobby. The decision belongs to the organization, and it should be recorded: which perimeters exist, what each protects, what risk assessment justified its strength, and who approved it. Confirm with your risk owner how often that record is reviewed and what triggers a review, such as a new tenant, a moved rack or a change in data classification.

The hardest part is usually the gap between the drawing and the building. A perimeter can be correct in the policy and the asset register while a propped fire door, a suspended ceiling that runs over a server room wall, an unlocked cage or a shared loading corridor quietly breaks it. Auditors often walk the boundary themselves, starting from the outside, checking where the line really runs, which doors are on access control, and whether anyone can reach the protected space without passing through a controlled point. Before the audit, walk each perimeter with the facilities team, photograph the boundary, and compare it against the site plan and your asset register. The evidence to keep is the perimeter register, the risk justification, access configuration records and dated walkthrough notes.

Which areas and boundaries fall under A.7.1

A.7.1 applies to any area that holds information or associated assets, which is wider than the building the organization owns. The cards below cover the scoping decisions that change the work, from in-house rooms to landlord, hosting and cloud sites, and show where the organization's own perimeter ends and inherited evidence begins.

Data centers and server rooms

A server room inside an office is a secure area in its own right, so it needs its own defined boundary: walls, a locked door, and a record of who can open it. A dedicated data hall in a colocation facility is the same question at a larger scale. For A.7.1, the auditor will ask where the boundary is drawn on a floor plan and whether the drawing matches what a visitor actually meets when walking in. Confirm the boundary with the facility operator in writing before relying on it.

Office floors holding sensitive records

Many organizations treat the whole office as the perimeter, yet a finance team's file room or an HR floor may hold far more sensitive material than the reception area. Scoping decisions should separate general office space from zones holding customer data, payroll or credentials. Check whether the perimeter includes the route between the lobby and those zones, and whether doors and badge readers along that route match the risk assigned to the room behind them.

Storage and archive rooms

Paper archives, backup tape and spare hardware are often kept in basements, storerooms or off-site units that receive less attention than production areas. Each storage location that holds information belongs in the scope decision, even if no one works there daily. Record the perimeter for each room, the holder of the keys, and the process for granting access. An auditor will often ask for one of these rooms specifically because it is easy to forget.

Sites run by hosting or third-party providers

When a hosting provider, facilities manager or managed service runs a site, the organization usually owns the systems but not the walls, doors or guards. The perimeter for those assets is a shared arrangement, defined in the contract and the provider's own reports. Confirm which physical controls the provider operates, which the organization requires to be evidenced, and how the provider's controls are reviewed, since the organization remains accountable for information it places there.

Inherited versus owned evidence

A cloud provider's or landlord's perimeter can supply evidence the organization may rely on, such as independent assurance reports or access logs for its facilities. The organization still owns its own boundary decisions, its access rules for those areas, and the evidence of how its people and equipment interact with the boundary. Make a two-column list of each physical control: which party operates it, which party produces the evidence, and which evidence the organization must hold itself.

Remote and co-located racks

Equipment in a co-located cage or on a remote rack is physically outside the organization's premises, yet it may hold its most sensitive systems. The cage or rack perimeter is usually defined by the colocation operator, so the organization needs to confirm the cage locks, the escort rules and the operator's access records. Agree in advance how a remote site will be included in the assessment and how the organization will obtain evidence when it cannot walk the boundary itself.

How to design a perimeter that matches the risk

Start by identifying the secure areas, meaning the rooms, floors, buildings or sites where information and associated assets are stored, processed or handled, such as server rooms, records stores, network closets, print and mail rooms, and areas where backup media is kept. Then group them by value and threat. A common approach is to draw zones in concentric layers: an outer boundary such as the site fence or building envelope, an inner boundary such as the floor or suite, and an innermost boundary around the highest-value rooms. Each boundary should have a named owner, a written purpose and a documented list of what it protects. ISO/IEC 27001:2022 does not prescribe walls, doors, gates, barriers or locks, and it does not specify a required construction class. That means the reasoning behind each boundary is the evidence. Record the threat assumptions, the asset values, the risk assessment result that drove the choice, and why the chosen construction is proportionate. An auditor who asks why a data room has a standard door and not a reinforced one should be able to read the answer in one document.

Match each boundary's strength to what sits behind it. Outer perimeters usually rely on deterrence and delay: fencing, controlled vehicle access, lighting and sound construction on external walls. Inner boundaries around secure areas usually need solid-core or reinforced doors, frames that resist being lifted off hinges, ceilings and walls that run to the structural slab where the threat model requires it, and locks that are logged or audited. Decide which openings need special treatment, including loading bays, roof access, ventilation ducts and windows. Your risk assessment should show where a weak point would expose the most valuable asset. The boundary decision also sets where A.7.2 Physical entry controls begin, since the first controlled door on each zone is where authorization checks, visitor logs and badge readers belong. Similarly, A.7.4 Physical security monitoring should start at the perimeter line, so that cameras, intrusion sensors or guard patrols cover every approach to the boundary and not just the room behind it. Confirm the exact requirements for your jurisdiction and insurer with a qualified building or security professional, and keep their recommendations in the same record.

How an assessor walks and tests the boundary

This table follows an assessor from the documented perimeter definition to the physical boundary itself, showing what each step tests, the evidence usually requested and where perimeters tend to fail. Read it as a preparation checklist: the first column is the test step, and the later columns show what the assessor expects to see and what commonly goes wrong.

Test step	What the assessor checks	Evidence requested	Common findings
Confirm the perimeter definition	The documented perimeter names the protected areas, the boundary elements and the owner of each, and matches the asset inventory and site plans.	Perimeter definition, site plans marked with boundaries, and the register of secure areas	Definition lists rooms that have since moved or omits a server room added after the last review
Walk the boundary with the site owner	The assessor follows the boundary on foot with the person responsible for the site and asks how each segment is controlled.	Walk notes, the named site owner, and the agenda or floor plan used during the walk	Owner cannot explain who controls a loading dock or shared corridor that forms part of the boundary
Inspect doors, barriers and walls	Doors, gates, fences, ceilings and raised floors are physically sound, and no gap bypasses the stated control.	Photographs or inspection records of each boundary element and maintenance or repair tickets	Walls that run only to a false ceiling, damaged door frames, or gaps under fire doors
Check the risk rationale against the strength chosen	The barrier strength matches the sensitivity of the protected area and the threats in the site risk assessment.	Risk assessment entries for each secure area and the specification of the chosen barrier	Highest-value room protected by the same door as a general storage area, with no documented reason
Sample changes since the last audit	Renovations, new rooms, relocated equipment and changed tenancy have been reflected in the perimeter definition and controls.	Change records, building work approvals, and updated plans with dates	New area fitted out without a perimeter review, or a tenant moved in next to a secure room
Look for propped doors	Secured doors close and latch, and no fire-safety or convenience wedge defeats the boundary during normal hours.	Door monitoring or alarm logs where available, and records of routine checks by staff	Doors wedged open during deliveries that were never reported or corrected
Look for unlocked gaps	Every route into a secure area is either locked, monitored or staffed, including service hatches, roof voids and back entrances.	Access control configuration or key register for each boundary point	Unlocked side door used for cleaning, or a keypad door whose reader is disabled
Look for undocumented access points	Physical routes not on the plans, such as legacy cable ducts, riser cupboards or adjacent building links, are identified and controlled.	Reconciled list of all doors and openings against the site plan, with a note on each added or sealed point	Riser cupboard on the boundary never added to the definition or inspection routine

Implementing A.7.1 step by step

This sequence turns the Annex A physical perimeter requirement into a documented perimeter map, zone-by-zone strength requirements, verified construction and a review cycle that an auditor can walk and test.

Inventory secure areas from the asset register
Start from the asset register and the information security risk assessment to list every area that holds information or associated assets, including server rooms, records storage, network closets, labs, and areas where sensitive work happens. Include areas outside your own building, such as shared floors or colocation cages, if your controls depend on them. The owner of each area confirms the list and the assets it contains. Done means you have a single inventory where each secure area is named, linked to the assets it protects, and tied to a risk entry that explains why it needs a boundary.
Draw and document the perimeter map
Produce a floor plan or site map for each location that shows every physical boundary around the inventoried areas: exterior walls, fenced yards, doors, interior partitions, and any gaps where a boundary is missing. Label each perimeter with an identifier that matches the inventory. Facilities or site management usually produce the drawings, and the security owner reviews them against the risk entries. Done means each secure area has a mapped perimeter with an identifier, and every boundary is traceable to a document an auditor can read without help.
Set strength requirements per zone
For each mapped perimeter, define the minimum physical strength that the risk assessment justifies. Specify construction standards for walls, doors, windows, ceilings, and any openings that connect to adjacent spaces, along with lock and access device requirements. Higher-risk zones usually need stronger boundaries and more restricted openings than general office space. The security owner approves the requirements and facilities confirms they are buildable. Done means each perimeter zone has a written strength requirement that can be compared against what is physically installed.
Verify physical construction against requirements
Walk each perimeter with the requirements in hand and compare the installed construction with the written standard. Check doors and frames, wall extensions above suspended ceilings, raised floors, fencing, ventilation openings, and windows. Record measurements, photographs where permitted, and any deviation. Where a site uses a third party for building works, obtain the installation records. Done means every perimeter has a dated verification record showing either that it meets the requirement or that a documented deviation exists.
Record exceptions and assign owners
Log each deviation, weakness, or accepted risk in an exceptions register. For each entry, record the perimeter identifier, the gap, the compensating measure in place, the accountable owner, and the decision date and approver. Exceptions with no owner or no compensating control should be escalated to the risk owner rather than left open. Done means the register contains every known gap, each with a named owner and a recorded decision, so an auditor can trace from a weak boundary to the person who accepted it.
Schedule periodic review and change triggers
Set a review schedule for the perimeter map and verification records, and define events that force an earlier review, such as office moves, new secure rooms, building works, changes in tenancy, or a security incident. Assign the reviewer, and keep the review record with the perimeter documents. The ISMS management review and internal audit programs can cover this check. Done means the schedule and triggers are written into the procedure, and the most recent review is dated and signed.

Evidence that passes an A.7.1 audit

An assessor testing A.7.1 wants to see that the perimeter was designed on purpose, that each boundary matches the risk of what sits behind it, and that the records still match the building today. The cards below cover the core artifacts and how to keep each one current between audits without rebuilding it every year.

Floor plans with marked perimeters

A current floor plan for each site, with every security perimeter drawn and labeled: external walls, secure rooms, server areas, storage and loading zones. The assessor compares the drawing against a physical walk, so each boundary must match what is on the ground. Keep the drawing in version control with a dated revision and the name of the person who approved it. Reconfirm it at each change to the building, not on a fixed annual cycle.

Risk assessment linking zones to strength

The document that explains why each perimeter is as strong as it is. For every zone, record the assets inside, the threats considered, the chosen barrier and access method, and the residual risk accepted by the owner. An assessor will ask why a data hall has a different boundary from a meeting room, and this record is the answer. Update only the zones whose contents, threats or access rules have changed, and log the date of each review.

Site inspection records

Dated records of physical inspections of each perimeter, showing who walked the boundary, what they checked (doors, fences, gates, windows, roof access, ceiling voids) and what they found. Use the same checklist each time so results are comparable across visits. Record defects and the date each was fixed. Ask the site owner to confirm the inspection frequency in the ISMS procedure, then keep to it, since an assessor will compare the records against that stated frequency.

Photographs and inspection checklists

Dated photographs of each boundary element, taken during the inspection and stored with the checklist. Photographs show door frames, gaps, mounted hardware and signage in a way a written note cannot. Keep a fixed photo set per zone, such as one shot per door and one per external wall section, so new photos can be compared with old ones. Store them in a restricted location, because images of server rooms and security hardware are sensitive in their own right.

Change records for doors and barriers

A log of every change to a perimeter element: new doors, altered locks, replaced fencing, added or removed windows, and any temporary openings for works. Each entry should name the requester, the approver, the reason, the date and the post-change inspection result. An auditor often picks one door and asks how its current state was approved. Link these entries to the floor plan revision so the drawing and the change history agree.

Exception logs for propped or bypassed boundaries

A register of every time a perimeter was opened outside its normal state, such as a propped fire door, a disabled door alarm during maintenance or a boundary crossed by an approved contractor. Each exception needs an owner, a time limit, a compensating control and a closure date. Assessors read these logs to judge whether exceptions are rare and controlled or routine and unmanaged. Review open exceptions at each inspection and close those that have expired.

What meeting A.7.1 costs in money and effort

This table breaks down the cost components of meeting A.7.1 perimeter controls, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request and to separate capital work on the site from the internal effort of keeping evidence current. No prices are given because none are supplied; ask each provider to price the components separately.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it
Site survey and perimeter drawings	Internal facilities or security staff, sometimes an external surveyor or consultant	One-time, refreshed when the site changes	Number of sites, number of zones, and whether drawings already exist and match the building
Risk-based perimeter design	Internal security team, with a consultant if the organization wants an outside review	One-time, revisited on risk reassessment	Sensitivity of the information inside each area and the threat profile for each location
Physical upgrades to doors, barriers and boundaries	Building contractors and hardware suppliers, paid per the written scope	One-time capital work, with some recurring maintenance	Construction state of existing walls and doors, fire code limits, and how many boundaries need strengthening
Internal time for owners and inspections	Control owners, facilities managers and security staff	Recurring, scheduled checks of doors, barriers and boundary integrity	Number of perimeters, inspection frequency set in the organization's own procedure, and staff turnover
Evidence upkeep	Internal compliance or security staff, or an implementation partner if the work is contracted	Recurring, including after any building change	Whether perimeter records live in one register or scattered across facilities files, and how often layouts change
Auditor sampling and walkthroughs	Certification body or independent auditor, paid under its own contract	Recurring at each audit, including surveillance and recertification visits	Number of sites in scope, number of perimeters sampled, and whether the auditor needs escorted site access
Remediation of findings	Internal teams and contractors for any nonconformity raised	One-time per finding, then verified again	Quality of the baseline records and how quickly gaps are closed before the audit

Who owns the perimeter and who can help

The organization owns the perimeter. Its leadership and security function decide which areas hold information or associated assets, how far each boundary extends, how strong each barrier must be for the risk involved, and who is accountable for keeping it that way. These decisions belong in the organization's own risk assessment and in its Statement of Applicability, because the auditor will test whether the boundary matches what the organization said it protects. Facilities, security and IT staff carry out the physical measures, and the organization remains responsible for them even when a contractor installs or maintains them.

Perimeter decision: Naming each secure area, its boundary and the reason for it, approved by an accountable manager.
Risk linkage: Recording why each barrier strength was chosen, tied to the risk treatment plan.
Physical operation: Keeping locks, doors, barriers and access points working and inspected.
Ownership of exceptions: Approving and tracking any deviation from the defined boundary.
Internal review: Checking the boundary periodically against changes in the site or in the information held.

Before engaging anyone, confirm that a named owner can sign off the perimeter definition without outside help.

Where organizations fall short on physical perimeters

Most perimeter failures are not missing walls. They are boundaries that drifted from the current site, risk and occupancy while the documentation stayed the same. The cards below cover the gaps assessors most often find when they walk a boundary and compare it with the records.

Perimeters drawn for one layout

A perimeter defined for the original floor plan often misses a room added later, such as a new server closet, a storage room carved from an open office, or a temporary lab. The new room may sit inside a boundary that was never extended to cover it, or outside every boundary altogether. Check the perimeter register against the current floor plan, room by room, and confirm who approved each change. Closing action: re-walk the site after every fit-out and update the register before the room is used.

No link between risk and strength

Many organizations apply one door specification everywhere, so a public lobby and a room holding production backups have the same protection. A.7.1 expects the strength of each perimeter to reflect the information and assets inside it, which requires a documented risk assessment behind the design choice. Ask who wrote the rationale for each boundary and whether it names the assets it protects. Closing action: record the risk basis for each perimeter in the register so the strength can be justified to an assessor.

Shared doors left open

A secure room often shares a corridor, lift lobby or loading door with areas used by other tenants, contractors or the public. When a shared door is propped open for deliveries or convenience, the boundary of the secure area is effectively gone for that period. Auditors look for door position logs, propping controls and whether staff know which doors form the boundary. Closing action: assign an owner to every shared door and test that it closes and latches as the design requires.

Landlord-owned boundaries assumed covered

Organizations that lease floors or units often assume the building's external walls, roof access, riser cupboards or shared plant rooms are protected because the landlord manages them. The perimeter that matters to your ISMS may include parts you do not control. Confirm in writing which boundaries the landlord maintains, what access they grant, and how changes are notified. Closing action: put the landlord's responsibilities in the lease or service agreement and map each shared boundary to a named party.

Stale floor plans as evidence

Floor plans that show walls, doors and rooms as they looked at the last refit are a common source of audit findings because they no longer match what the assessor sees. Plans are also used to show where perimeters run, so an outdated plan undermines the whole boundary design. Confirm the plan date, who holds the controlled copy, and how changes trigger an update. Closing action: version the floor plan with the perimeter register and reconcile both at each scheduled review.

Questions buyers ask about A.7.1

How much effort does it take to meet A.7.1 physical security perimeters?

Effort depends mostly on how many sites, buildings and secure rooms fall in scope and how much of the boundary already has documented controls. A single office with one controlled entrance needs a short definition of the perimeter, a list of protected areas and evidence that the boundary is enforced. A data hall or multi-floor site needs a perimeter map per site, risk-based strength decisions for each wall, door and window, and records showing the boundary is walked and tested. Ask any provider to break effort into scoping, site surveys, remediation of physical gaps and evidence collection, because much of the work lands on facilities and property teams, not on the security team.

Can a small team handle A.7.1 without outside help?

Often yes, if the premises are a single site with a clear boundary and the team can get facilities staff to cooperate. The work is mostly documentation, a site walk, a decision record on perimeter strength and a schedule for checking the boundary. Small teams usually struggle when the building is shared with other tenants, the landlord controls the doors, or the perimeter runs through rooms that the company does not manage. In those cases, the organization still owns the control, but outside help can prepare the survey, draft the perimeter record and organize the evidence so the team does not have to reconstruct it during the audit.

How long does a perimeter review take in general terms?

The duration depends on site count, site size, the number of distinct boundaries and whether the review is a first pass or a repeat check. A first review usually involves reading existing floor plans, walking every boundary with facilities staff, comparing what is installed against the risk decision and recording gaps. Repeat reviews are shorter because the perimeter map already exists. No duration is fixed by the standard, so ask a provider for a written timeline tied to a stated site list and deliverables. Also confirm when the findings will feed into remediation, because a review that ends in a long list of open items has not yet produced a working control.

What should I ask a consultant to deliver for A.7.1?

Ask for a written scope listing each site and secured area, a perimeter map or annotated floor plan, and a record of how each boundary was assessed against risk. Also request a gap list with owners, a remediation plan that separates work the organization must fund from work the landlord or facilities provider controls, and a template for the recurring boundary walk. Confirm who will sign off the Statement of Applicability entry for A.7.1 and who keeps the evidence. A reputable implementation partner prepares systems and evidence, but the organization owns the control and the certification body or auditor, not the consultant, issues any certificate. Ask for a clear statement of what is excluded.

Do cloud-hosted workloads need a physical perimeter of their own?

The organization does not build a physical perimeter around a cloud provider's data center, but it still needs one around every place it controls where information or associated assets are held, such as offices, server rooms, network closets and storage areas. For cloud workloads, the relevant question is which provider controls the physical boundary and what evidence the provider supplies, such as independent reports or certifications that cover its facilities. Review those reports and the provider's shared responsibility documentation, and record which physical controls sit with the provider and which sit with the organization. Confirm the details with each provider, because scopes and report types differ.

Which evidence does an auditor expect to see for A.7.1?

An auditor usually looks for a documented definition of each security perimeter, a record of which areas it protects, and a rationale that links the boundary strength to the risk assessment. Expect to show photographs or floor plans, the list of physical barriers and access points, and proof that the boundary is walked and checked on a schedule. Records of corrective actions for weaknesses found in earlier walks also help. The auditor will test whether the documented perimeter matches what is on the ground, so keep the perimeter map current after building changes, tenant moves or new rooms are added.

How do open-source tools help with A.7.1 evidence?

Open-source tools do not secure a building, but they can store and version the evidence that proves the perimeter is defined and checked. A self-hosted wiki or document repository can hold perimeter maps, a ticketing system can track gaps and remediation, and a scheduled task can remind staff to run the boundary walk. Physical access and monitoring systems often have their own vendors, so confirm which logs can be exported and retained inside the organization's own infrastructure. Record the tool names, configuration and retention settings in the control documentation so an auditor can trace each evidence item to its source.

How DeployOpen prepares A.7.1 evidence

DeployOpen works on A.7.1 Physical security perimeters as part of a written scope agreed before work starts. We help define the perimeter boundaries inside your own sites and environments, prepare the controls and records that show those boundaries are used, and document them for your auditor. The organization keeps ownership of its controls, and only an independent auditor or certification body issues any report or certificate.

How we scope

Agree in writing which sites, secure areas and information assets fall inside the defined perimeters.
Record the risk basis for each perimeter so its strength can be explained to an auditor.
Confirm which A.7.2 to A.7.4 controls are in scope, since entry and monitoring depend on the perimeter.

How we build

Prepare the perimeter register, including boundary descriptions, zone labels and access rules for each area.
Configure access control and logging records for systems that support perimeter enforcement in your environment.
Test the boundary records against the written design to find gaps before an auditor walks the site.

How we hand over

Deliver the perimeter documentation, control mapping and evidence index in formats your team can maintain.
Walk your staff through how each perimeter record is updated, reviewed and retained over time.
Provide a clear list of items the organization must still verify on site, such as physical barriers and signage.

How we support

Ongoing support, upgrades and periodic review of perimeter records are available as a retainer.
Support can cover changes to sites, new secure areas and updates to the Statement of Applicability entries.
Ask any prospective partner to confirm in writing how perimeter reviews and evidence refreshes are scoped and billed.