A.7.2 Physical entry: requirements and evidence

What A.7.2 physical entry asks for and why auditors check it first

If you must show that only authorized people physically reach rooms holding information and equipment, A.7.2 Physical entry is the control to start with. It asks that secure areas are protected by appropriate entry controls and access points, so that only authorized physical access to information and other associated assets takes place. In practice that means every route into a secure area, from the main door to a loading bay, has a defined way to decide who passes, record that they passed, and stop those who should not. The risks it targets are familiar: unauthorized people walking in, tailgating behind an employee, visitors who are never logged, and deliveries that enter a secure space without anyone checking them. The control also has a wider scope than its 2013 predecessors. A.7.2 merges A.11.1.2 Physical entry controls and A.11.1.6 Delivery and loading areas from the 2013 edition, so visitor handling and the handling of goods at the dock now sit under one control. Auditors will expect you to show both. Before you write anything, map every entrance to the secure areas it serves, including doors shared with tenants, fire exits and any dock run by a third party, because each of those is a point an assessor can test.

This control is hard for predictable reasons. Shared entrances mean the organization does not fully control who holds a key card or a door code. Loading docks are often operated by couriers or landlords who follow their own procedures. Access rights also tend to outlive their purpose: a contractor's badge from a finished project or a former employee's card can remain active for months because nobody owns the review. The organization owns this control and decides how entry is run. An independent auditor then samples entry logs, authorization records and visitor registers and decides whether the control works as described. An implementation partner can help configure access systems and prepare the evidence, but it does not issue the conclusion. A useful first step is to ask the site owner to produce the current list of people authorized for each secure area, the visitor log for the last few months and the delivery records for the dock, then compare them. Confirm with your certification body how it will sample these records, and confirm with your facilities provider which entry systems keep logs and for how long. Gaps found at this stage are much cheaper to fix than those raised as nonconformities during an audit.

Which entry points, people and third parties fall inside A.7.2

A.7.2 applies to every route into a secure area, not only the main door. The cards below cover the scoping decisions that most often shift the boundary, and each one should be checked against your Statement of Applicability and your A.7.1 perimeter definition before the entry controls are designed.

Secure areas and their doors

Start with the list of secure areas, then count every door, gate, turnstile and hatch that opens into each one, including fire exits and roof or service access. Each opening needs an entry control that matches the risk of the room behind it. A common gap is a server room with a badge reader on the main door and an unlocked emergency exit that opens from inside without logging. Confirm the list of doors against the physical walk-through your A.7.1 perimeter record describes.

Visitors and escorted contractors

Visitors who enter a secure area are part of A.7.2 because the entry process decides who is authorized to be present. Record the visitor's identity, purpose, host, time in and time out, and the escort who stays with them. Contractors who need repeated access should be handled as staff with their own authorization records, not as anonymous visitors. Confirm with the site owner who signs off on visitor access and where those records are kept.

Delivery and loading areas

Loading docks are often the weakest entry point because they sit at the building edge and handle equipment that may carry media or hardware. A.7.2 merges the earlier control on delivery and loading areas into the entry requirement, so deliveries that reach a secure area or its storage must be checked and logged. Decide whether goods are received outside the secure area and moved in under supervision, and confirm that the dock door is not open at the same time as the secure door.

Shared building entrances

If the organization shares a lobby, stairwell or lift with other tenants, the controls at those shared points still shape who can reach its secure areas. Decide which shared entrance points you rely on, and whether the building operator's badge system or your own reader sits at the last barrier. Confirm in writing who controls and logs each shared point, because an auditor will ask for records of that control even when someone else operates it.

Cleaning and maintenance staff

Cleaning crews, facilities technicians and building maintenance staff often hold keys or access cards that reach secure areas outside normal hours. Decide whether their access is granted by your organization, the building operator or a subcontractor, and whether it is limited to set times with supervision. A.7.2 expects the authorization and access records for these groups to be reviewed like any other access. Confirm how keys and cards are issued, returned and checked.

Hosted and colocated facilities

In a colocation or managed data center, the facility operator often runs the badge system, biometric readers and visitor log for the cage or suite. Whether that counts as your control depends on the contract and on what you can see and prove. If the operator's logs are the only entry record, confirm that you can obtain them on request, that they cover your secure area, and that the operator's assessment report or your own review covers entry. Confirm the split against your Statement of Applicability and the A.7.1 perimeter definition, and consider whether the operator's independent assurance report covers the controls you rely on.

How an assessor tests physical entry and what they ask to see

This table compares what an assessor does, the evidence they request and the common findings for each test area under A.7.2. Read it as a preparation checklist: each row shows what the assessor will walk, sample or reconcile, and where organizations usually fall short.

Test area	What the assessor does	Evidence requested	Common findings
Site walkthrough of entry points	Walks every route into secure areas during the site visit, including doors, turnstiles, reception and any unmanned side or service entrances	Floor plans marking secure areas and entry points, plus a list of doors with their access control method	Doors that are propped open, unlisted side entrances, or readers that do not match the documented door list
Sampling of access grants	Selects a sample of recent grants and checks that each has a documented request, an owner approval and a business reason	Access request tickets, approval records and badge or key issue logs for the sampled people	Grants approved by someone without authority, or access granted without a recorded request
Sampling of access revocations	Compares leavers, role changes and contractor end dates against the time their physical access was removed	HR leaver and transfer lists, deactivation timestamps from the access control system, and returned key or badge records	Badges still active weeks after an employee left, or contractor access that outlived the contract
Visitor log reconciliation	Matches visitor register entries against escort assignments, temporary badge issue and badge return records	Visitor logs with sign-in and sign-out times, escort names, and temporary badge numbers	Visitors with no sign-out time, missing escorts, or temporary badges that were never returned or reconciled
Delivery and loading area review	Examines how deliveries are received, whether the loading area is separated from secure areas, and how incoming and outgoing items are recorded	Delivery and loading procedure, delivery logs, and records of items moved into or out of secure areas	Deliveries that reach secure areas unchecked, or loading bays with a direct, unmonitored path to the data hall or records room
Authorization records against current roles	Checks that the list of people authorized for each secure area matches current job roles and the most recent access review	Access authorization lists per area, role definitions, and the output of the latest periodic access review	Authorization lists that still show former staff, or access sets that are broader than the current role requires
Mapping references (adjacent, to confirm)	Notes that NIST's crosswalk relates A.7.2 to SP 800-53 PE-2, PE-3, PE-4, PE-5 and PE-16, and that NIST cautions mapped controls are not always equivalent, so the assessor tests the ISO wording	Evidence against the ISO 27001 requirement itself, not against a mapped control	Organizations that answer with another framework's control ID instead of the A.7.2 requirement
Other adjacent references (to confirm)	Notes that ENISA's NIS2 mapping links A.7.2 to points 11.1 and 13.3 of Implementing Regulation (EU) 2024/2690, and that CSF 2.0 subcategory PR.AA-06 is a related reference. Confirm both against their sources	Same evidence as above, presented so it can serve other frameworks without a second collection	Treating a mapping as proof of compliance with another framework's clause

Which evidence passes A.7.2 and how to keep it current between audits

An auditor testing A.7.2 looks for a complete trail, not a single good day. Each record below should show who was authorized, who approved it, when it changed and who reviewed it, and the set must cover the whole audit period.

Entry control policy and site procedure

The written policy states which secure areas have entry controls, which access points they cover and who owns them. The site access procedure turns that policy into steps guards and receptionists follow. Check that both carry a version number, an approval date and an owner, and that the procedure matches what staff do at each door. A policy that describes badge readers at a site where guards still sign people in on paper will fail review.

Access authorization register

The register lists each person granted access to each secure area, with the named approver and the date of approval. Auditors sample entries and ask for the justification. Each row should carry a unique identity, such as an employee or contractor ID, so the same person cannot appear under two names. Review the register against HR and contractor records each time a role changes or an engagement ends.

Badge and key issuance and revocation records

Issuance records show which physical credential went to which person, when, and who authorized it. Revocation records matter as much: they should show when access was removed, who removed it and the time it took effect. Compare the active credential list against the authorization register at regular intervals. Credentials still active for leavers or expired contractors are a common finding, so the gap between departure and revocation should be recorded.

Visitor logs with escort and exit times

A visitor log records name, organization, host, purpose, arrival time, the escort assigned and the exit time. Auditors check that escorts were named for visitors entering secure areas and that exit times are filled in. Blank exit fields and entries that were signed out by a different person are findings. Keep logs for the full audit period and store them where they cannot be edited after the fact.

Delivery and loading inspection records

Delivery and loading areas are where unauthorized items and people can enter unnoticed. The procedure should require that deliveries are logged on arrival, inspected and, where they are taken into secure areas, escorted and recorded. Inspection records show who checked the delivery, the time and any items refused or held. Confirm that loading dock doors are not open at the same time as internal doors to secure areas, and keep the inspection logs with the visitor records.

Periodic review of access holders

A recurring review asks the area owner to confirm, for each secure area, who still needs access and why. The review record should show the reviewer, the date, the list reviewed and each change made. Reviews that are signed without changes, or that never produce a removal, make auditors question whether anyone is checking. Schedule the review at a frequency set by your risk assessment, and keep every completed review for the audit period.

How to implement A.7.2 in sequence and what each step produces

The sequence moves from knowing where your secure areas and entry points are to a dated, reviewed record showing that only authorized people enter. Each step leaves a document an auditor can read, and the organization makes every decision that the records reflect.

Inventory secure areas and entry points
Start by listing every area that holds information or associated assets, such as server rooms, records stores, network closets and areas where sensitive work happens, along with every door, gate, hatch, turnstile and loading bay that leads into them. Facilities, security and the system owners usually do this together, because the physical plan and the asset register rarely match on their own. The output is an entry point register that names each secure area, its boundary and the access points that serve it. The step is done when a walk of the site finds no access point missing from the register.
Define who may enter each area
For each secure area, the organization decides which roles, contractors and third parties may enter, under what conditions and with whose approval. Those decisions should trace back to the asset classification and the access control policy that A.5.15 requires, so that physical access follows the same logic as system access. The output is an authorization matrix that lists areas against roles, the basis for each grant (job need, contract, escort) and the named owner who approves exceptions. The step is done when the matrix has been signed off by the owners of the assets in each area.
Set visitor and delivery rules
Write the procedure for visitors, couriers and deliveries separately, because the risks differ. Visitor rules cover identification, sign-in, badge issue and return, escort requirements and the areas a visitor may never enter. Delivery and loading rules cover where goods are received, how they are inspected, and how they are kept apart from secure areas until checked. The output is a written visitor procedure and a delivery and loading procedure, both approved by the control owner. The step is done when front-desk and dock staff can each explain the rule without reading the document aloud.
Configure entry control and logging
Choose the controls that match the risk of each area, such as locks, badge readers, PIN pads, a visitor management system or a bound logbook for low-risk spaces. Configure them so that each grant in the authorization matrix is reflected in the physical system, and so that every entry, denied attempt and visitor sign-in produces a record with a time, a person and a point of entry. Self-hosted access control or visitor software can hold these logs in your own environment, but the vendor must be confirmed for the features you need. The output is a configuration record and a log that can be exported for review. The step is done when a test badge and a test visitor both produce the expected log entries.
Train staff on escorting and challenging
Staff who hold keys, badges or reception duties need to know what to do when someone is in the wrong place. Training should cover escorting visitors, challenging unknown people in secure areas, reporting tailgating and lost badges, and what to do when an access system fails. Records of who was trained, when and on which version of the procedure are part of the evidence an auditor will ask for. The output is training content, attendance records and a short acknowledgement from each person in scope. The step is done when every person in the authorization matrix has a current training record.
Run a first access review
Compare the authorization matrix with the actual access list in the lock or badge system and with the visitor and delivery logs. Look for people who hold access they no longer need, badges that were never revoked, visitors who entered secure areas without an escort, and log gaps. Each finding should have an owner and a corrective action. The output is a dated review record that lists the scope, the sample reviewed, the findings and the actions taken. The step is done when every finding is closed or accepted by the risk owner in writing.
Schedule recurring reviews
Set a review cycle for the authorization matrix, the access lists, the visitor logs and the procedures, and assign an owner for each. The cycle should match the risk of the areas and any changes in staff, contractors or sites, and the organization should confirm what its own policy and its certification body expect. The output is a review calendar, a review template and a change log that records when access rules were updated and why. The step is done when the next review is on the calendar and the previous review's records are filed where the auditor can find them.

What meeting A.7.2 costs in money and staff effort

This table lists each cost component of meeting A.7.2 Physical entry, who is paid for it, whether it is one-time or recurring, and what pushes it up or down. Use it to structure a quote request, since no figures are published here and each cost depends on the written scope of your sites and visitor flows.

Cost component	One-time or recurring	Who is paid or who spends time	Main cost driver
Access control hardware and readers for secure areas	One-time, with recurring maintenance	Hardware vendor or installer, plus internal facilities staff	Number of secure areas and doors that need entry control
Visitor or access management system licenses	Recurring (subscription or license renewal), or none if self-hosted	Software vendor, or DeployOpen for self-hosted open-source setup	Number of sites, user count and whether logs are kept in a commercial product
Staff time for authorization and access reviews	Recurring	Facilities, security and line managers approving and reviewing access	Number of people with secure area rights and how often reviews run
Reception and guard time for visitor and delivery handling	Recurring	Reception, guard contractor or in-house staff	Volume of visitors and deliveries, and whether sign-in is manual or digital
Evidence upkeep for access logs and authorization records	Recurring	Internal compliance or security staff, plus storage costs	Whether logs are kept on paper or in a system, and retention period set by the organization
Independent testing of physical entry controls	Recurring, usually per test cycle	External tester or assessor, scoped in writing	Number of sites tested and whether social engineering of entry points is included
Auditor sampling time for entry controls	Recurring, with each audit cycle	Certification body, invoiced under its own agreement	Number of sites in scope and the volume of records the auditor samples

Who does what for A.7.2: your team, an implementation partner and the auditor

Your organization owns A.7.2. Under the ISMS, the entry policy, the list of secure areas and the decision on who receives access sit with named people in your organization, and those people remain accountable whether or not an outside party helps. Your team approves each access grant and removal, decides how visitors and deliveries are handled at each site, and runs the periodic review of who still has access. Site decisions, such as whether a loading bay may open into a server room corridor, are yours to make and to document.

Policy and scope: Write and approve the entry rules, define which areas are secure, and assign an owner for each access point.
Authorization decisions: Approve, change and revoke physical access, and keep the approval record that links each person to a business reason.
Visitor and delivery rules: Decide escort requirements, identification checks and where deliveries are received, then brief staff and reception on them.
Periodic reviews: Run the access reviews yourself, with sign-off by a manager who knows the area.
Site and facilities decisions: Own changes to doors, badge systems and guard arrangements, and the risk trade-offs behind them.

Before relying on this split, confirm with your auditor which records they expect you to sign off personally, because that list is the one most often found missing.

Where organizations fall short on physical entry and how to close each gap

Physical entry gaps tend to show up at the seams between HR, facilities, security and reception, where access is granted in one system and never revoked in another. Each card below names a gap an auditor is likely to probe, the practical fix, and the record that proves the fix works.

Access rights never revoked

Badges and door permissions often outlive the role that justified them. Tie every entry right to a named owner and an approved request, and link the leavers and movers list from HR to the access system so changes trigger removal. The evidence is a reconciliation showing that badges for recent leavers and transferees were disabled within the period the organization set in its procedure. Ask the auditor to sample a few departures and trace each one to a revocation record.

Incomplete or unsigned visitor logs

Visitor registers with missing names, times or host signatures make it impossible to show who was inside a secure area. Require pre-registration, identity checks, a badge that is visibly escorted, and a sign-out entry for every visit. The evidence is a complete log for a sample period, with host sign-off and matching badge return records. Check that gaps in the log are investigated rather than left blank.

Delivery areas that bypass secure zones

Loading docks often connect straight to corridors that lead to server rooms or document storage. Separate the delivery area from secure space with a controlled door, and require that incoming goods are inspected and moved into the secure area only through an authorized route. The evidence is a floor plan showing the separation, a log of deliveries with receiving staff, and a record of any deliveries that were refused or escorted.

Tailgating and unlogged shared doors

Propped doors and shared badges let people enter without a traceable record. Configure readers to log each entry against one person, alarm on doors held open, and set a rule that every individual passes their own credential. The evidence is an event log that attributes entries to individuals, a list of door-held alarms, and records showing staff responded. Confirm the log retention period with the platform owner and your own policy.

Third-party access outside your records

Cleaners, contractors and facility vendors sometimes hold keys or codes that the organization never records. Bring every third-party identity into the same register as employees, with a sponsor, a defined purpose and an end date. The evidence is a current access list for vendors, sponsor approvals, and removal records when contracts end. Ask the auditor to test whether the vendor list matches what the facility team actually issued.

No periodic access review

Entry rights drift over time even when each change was correct. Schedule a recurring review in which each area owner confirms who still needs access, and record every removal or retention decision. The evidence is signed review records with dates, the list reviewed, and actions taken on exceptions. Confirm the review frequency that fits your risk assessment, since the standard does not set one for you.

What buyers ask about A.7.2 cost, effort and outside help

How much effort does A.7.2 physical entry take for a small office versus a data center?

Effort scales with the number of secure areas, entry points and people who hold access, so a small office with one controlled door and a short visitor list is a far smaller job than a data center with multiple perimeters, mantraps, badge zones and contracted staff. In a small office, the work is mostly a written access policy, a short list of who holds keys or badges, a visitor log and a periodic review. In a data center, the work includes access zoning, badge provisioning and revocation workflows, reader and camera configuration, integration with identity systems, escort rules for contractors and delivery handling at loading docks. Ask the implementation partner to size the work from a written list of secure areas and entry points, not from the company's headcount alone.

Can a small team meet A.7.2 without outside help?

Yes, a capable internal team can meet A.7.2 if it owns the controls, understands which areas count as secure and keeps records consistently. The organization remains responsible for the control either way. Outside help is most useful for preparing evidence in a consistent format, configuring access tooling, documenting the control design and running a readiness review before an independent auditor arrives. Only the independent certification body issues the certificate. Decide early who will run the access reviews, who approves new badges and who checks the visitor log each month, because an unowned control usually fails at the first audit.

What does A.7.2 require from staff day to day?

A.7.2 needs staff to follow the entry rules every day, not only during audit preparation. Typical duties include issuing and collecting credentials, escorting visitors and contractors, challenging unknown people in restricted areas, recording deliveries and keeping doors closed. Receptionists, facilities staff, security guards and the teams that hire contractors all carry part of the work. Plan short briefings for each group, add the rules to onboarding, and check that people understand what to do when a badge fails or a visitor arrives without an appointment. Staff behavior is what an auditor observes during walkthroughs, so training that is written down but never practiced leaves gaps.

How long does it take to get A.7.2 records in shape?

The time depends on how many access records already exist and whether they are consistent. No duration is given here because none has been researched for this control. Tasks that drive the timeline include reconciling the current access list against HR and contractor records, deciding which entry points belong to which secure area, creating a visitor and delivery log format, and collecting several months of entries so an auditor can sample them. Ask the implementation partner for a schedule in the written scope with named milestones, and ask the organization to confirm how far back its logs are retained.

Does a landlord or colocation provider's entry controls count toward A.7.2?

A landlord or colocation provider's controls can support A.7.2 but do not replace the organization's own obligations for areas it controls. The organization must know which secure areas it occupies, what the provider's entry controls cover and whether it can obtain the provider's access logs, visitor records and delivery records on request. Review the contract and service descriptions, ask for the provider's own audit reports where available, and document the shared responsibilities in the Statement of Applicability. Where the provider's records are inaccessible, the organization may need its own cage, badge or cabinet controls to produce evidence.

What will an auditor sample when testing A.7.2?

An auditor usually reviews the written entry policy, samples access authorizations, checks visitor and delivery logs against stated rules, and walks the entry points to see whether controls work as described. Expect requests for a sample of badge grants and revocations, the list of people with access to each secure area, escort records for visitors and contractors, and evidence that access was reviewed at planned intervals. The auditor will also ask how exceptions are handled, such as a lost badge or a tailgating incident. Keep each record traceable to an approved request so the sample can be followed from start to finish.

What should a written quote for A.7.2 work include?

A written quote should follow from a written scope and list the secure areas and entry points in scope, the systems to be configured, the evidence to be prepared and the roles of each party. Ask for deliverables, such as the access policy, procedures, configuration records and an evidence index, and for the dates and assumptions behind them. Confirm what the organization must provide, including access to sites, HR records and existing logs, and what happens if the scope changes. Ask whether the partner will support an independent audit but will not issue any report or certificate, and whether ongoing reviews are included or offered as a separate retainer.

How DeployOpen scopes, implements and prepares A.7.2 evidence

DeployOpen works on A.7.2 Physical entry as an implementation partner. We prepare the entry control design, access records and visitor and delivery procedures inside your own sites and systems, while your organization owns the control and an independent auditor or certification body decides whether it meets the requirement.

How we scope

Agree in writing which secure areas, entry points and delivery areas fall under A.7.2 Physical entry.
Confirm which access systems, logs and visitor records already exist and which must be created.
Define who inside your organization owns each entry control and who approves changes to access rights.

How we build

Configure access control and logging for each secure area so that entries and denials are recorded consistently.
Set up visitor registration and escort procedures, with records retained in a system you control.
Document delivery and loading area handling so deliveries are authorized, supervised and logged before reaching secure areas.

How we hand over

Deliver the entry control documentation, access authorization records and log samples mapped to the A.7.2 requirement.
Walk your team through how to produce access reviews and visitor logs on request for an auditor.
Record open gaps and remediation owners so the evidence package is clear before any assessment begins.

How we support

Offer ongoing support for access changes, log reviews and procedure updates as an optional retainer.
Review entry logs and access lists on a schedule you agree in the written scope.
Confirm with your certification body which evidence formats it accepts before finalizing the package.