What A.7.3 asks for when your team works inside a building you control
A.7.3 asks your organization to design and apply physical security for offices, rooms and facilities so that unauthorized people cannot gain physical access to information and assets, and cannot cause damage or interference. The audit is coming, and the office is shared, leased, or mixed with public areas such as reception, a café, or a shared lobby. That is the situation this control was written for. The question an assessor will ask is simple: inside the building you occupy, what did you do to keep sensitive work and information away from people who should not see or reach it?
A.7.1 covers the boundary of the secure zone, and A.7.2 covers the controlled entry points into it. A.7.3 sits inside that boundary. It covers the rooms and spaces your team actually uses: the finance room, the engineering bay, the HR office, the board room, the server closet that is not in a data center. Even when the perimeter and entry controls are sound, a locked door on a room is only useful if the room's contents, its whiteboards, its screens and its paper stay out of view. Shared and leased buildings make this hard. Reception desks, meeting rooms booked for visitors, cleaning contractors, and tenants on the same floor all share access paths. Screens facing a corridor window, a printer in an open hallway, or a whiteboard with customer data visible from a glass wall can each defeat an otherwise well-designed room.
Start with a walk-through of every room and facility that holds sensitive information, and record who can reach it, what is visible from outside it, and where signage or room names reveal its purpose. Decide which rooms need lockable doors, card or key control, and restricted booking, and which sensitive activities should move out of public view. Confirm with your landlord or building manager which areas you control and which are shared, because responsibility for common corridors and lobbies affects what you can promise. Write the decisions down, since an assessor will test whether the design was reasoned and whether it is applied in practice.
Which rooms, facilities and teams fall under A.7.3 scope
Scope for A.7.3 starts from the ISMS scope and the Statement of Applicability, not from the floor plan. The cards below cover the places and people that most often raise the question, and each one is a decision the organization must make and document for itself.
Offices and rooms inside the perimeter
Open-plan floors, private offices, project rooms and any space where staff handle information inside the defined physical boundary. A.7.3 asks whether these rooms are locked, whether doors and windows are protected, and whether sensitive work can be overheard or seen from outside. Check each room against the ISMS scope and record why it is included or excluded. Walk the space at different times of day, since occupancy changes what is exposed.
Server and records rooms
Server rooms, comms cabinets and paper records stores often sit in the same building as offices but need stronger treatment. Most organizations bring them into scope and then check that keys, badges and signage do not reveal what is stored. Confirm whether these rooms are also secure areas under A.7.6, since the rules for working in them are stricter and need their own documented procedure.
Shared buildings and coworking space
When the organization shares a floor, building or coworking space with other tenants, the landlord or operator controls parts of the perimeter, reception and common corridors. The organization still owns the protection of its own rooms. Decide which shared areas fall within scope, document what the landlord provides, and confirm in writing who controls keys, access cards and cleaning access.
Reception and meeting rooms
Reception desks, visitor waiting areas and meeting rooms are where outsiders see the most. Screens, whiteboards, printed agendas and conversations can expose information without any intrusion. Assess whether meeting rooms are used for sensitive discussions, whether whiteboards are cleared, and whether reception staff can see or reach internal systems. Visitor entry rules belong under A.7.2, but the rooms themselves belong here.
Print and mail rooms
Shared printers, copiers, scanners and mail or courier areas hold output that can be collected by anyone passing through. Treat them as in scope when they handle documents classified under the organization's rules. Check whether printers hold stored jobs, whether mail is sorted in a controlled space, and whether discarded output is shredded or collected securely.
Contractors and cleaners
Cleaners, facilities staff, maintenance vendors and temporary contractors often enter rooms after hours with access that was granted for another purpose. Include them in scope when they can reach offices, records or equipment. Confirm which groups hold keys or badges, how their access is logged, and whether supervision or background screening applies. Any vendor arrangements should be recorded in the supplier controls that the Statement of Applicability references.
How an assessor tests office and room security
An assessor usually starts with a walk through the offices, server rooms and meeting spaces that sit inside the perimeter, with the people who run them. The purpose is to see whether the controls described in the ISMS work in the place where information is actually handled. The assessor pays attention to how a room is entered, whether doors close and lock behind people, where screens face, and whether sensitive material can be seen from a corridor or a shared space. The walk is observational, so the assessor will often ask the site lead to demonstrate a lock or show how a restricted room is kept closed.
- Doors and locks: Whether restricted rooms have locks that match their classification, and whether doors are self-closing and not propped open.
- Signage: Whether rooms holding sensitive activity are identified discreetly, without labels that advertise their contents.
- Sightlines: Whether screens, printers, whiteboards and paper in open areas are visible from windows, corridors or reception.
- Shared and transit areas: Whether visitors or contractors can reach areas that are not meant for them while the assessor is on site.
- Staff behavior: Whether people challenge unfamiliar individuals or follow the access rules the ISMS describes.
Before the walk, confirm which rooms are in scope and whether the assessor will be escorted, so that the walk reflects normal conditions rather than a rehearsed tour.
Beyond what is physically present, an assessor asks why the controls are shaped the way they are. A.7.3 is about protecting offices, rooms and facilities in proportion to what they hold, so the assessor expects the organization to explain how the room-level controls follow from its risk assessment and its classification of information. A lock on a supplies cupboard and a lock on a room where client records are reviewed should not be justified in the same way. The assessor checks whether the reasoning is written down, whether it links to identified risks, and whether the decisions were approved by the people accountable for them.
- Risk linkage: Records showing which risks led to room-level controls, traceable to the risk assessment and treatment plan.
- Classification mapping: A list of rooms or zones with the information classes they hold and the controls assigned to each.
- Statement of Applicability: The entry for A.7.3 and how it is justified, consistent with the actual design.
- Ownership: Named owners for each secured room who approved the arrangement and review it.
- Change history: Evidence that the rationale was revisited after office moves, reorganizations or new projects.
Before the audit, confirm that the rationale is in one place the assessor can open, and that it matches what the walk will show.
The assessor asks for records that show the controls operate over time, not only that they exist on the day of the visit. Evidence for room-level security usually includes access authorization records, key or badge management logs, visitor records for secured areas, and maintenance or inspection notes for locks and doors. The assessor samples these records, selecting a set of rooms, dates or individuals and checking that the entries are complete and consistent with the design. Where the organization relies on automated systems, the assessor also checks that logs cannot be altered easily and that someone reviews exceptions.
- Authorization records: Who was granted access to each restricted room, when, and who approved it.
- Revocation records: Evidence that access was removed when roles changed or people left, sampled against HR movements.
- Key and badge logs: Issue, return and loss records, with the reasons for any gaps.
- Inspection notes: Dated checks of locks, door closers and signage, with corrective actions.
- Review records: Periodic reviews of who can enter each room, signed by a responsible owner.
Before the audit, pull a sample of these records yourself and confirm that they can be produced quickly and that the entries agree with each other.
Certain findings appear often in office and room reviews, and they usually point to a gap between the written design and daily practice. Most are small individually, but an assessor may group several of them into a single nonconformity if they show that the control is not operating. The findings below are illustrative of patterns assessors describe, not a fixed list drawn from the standard.
- Propped doors: A fire door or restricted room door held open with a wedge, so that the lock has no effect during the day.
- Unattended visitors: Visitors or contractors left alone in a secured room or allowed to wander to areas outside their purpose.
- Visible client data: A whiteboard with customer names or figures that can be read from a corridor or through glass.
- No documented rationale: Room-level controls that exist in practice but have no recorded risk basis or owner.
- Stale access: Former staff or contractors whose access to a restricted room was never removed.
Before the audit, walk the space once as an outsider would, from the street-side entrance and the reception route, and note anything the assessor is likely to see first.
Implementing A.7.3 in six steps
This sequence turns A.7.3 from a general intent to protect offices into a set of classified rooms, documented protections, named owners and dated records that an auditor can sample and test.
Inventory rooms and facilities in scope
List every office, room and facility inside your physical security perimeters that holds or handles information or assets, including meeting rooms, print areas, server closets, mail rooms and reception counters. Confirm the list with facilities staff and building management, since they often know about rooms that IT does not. The output is a room register with a location, a floor plan reference and a named responsible department for each entry. Done means every room inside the perimeter appears once, with no unassigned entries.
Classify rooms by the information they hold
For each room, record the highest classification of information discussed, stored or processed there, such as customer records, payroll, source code, board materials or network equipment. Use the information classification scheme already defined under the organization's policies so that room classes match data classes. The output is a room class for each entry, such as public, internal, confidential or restricted, with a short justification. Done means the security team and data owners have reviewed each classification and signed off on rooms that hold mixed information.
Document the risk basis for each class
Link each room class to the risks it addresses, such as unauthorized viewing of screens, theft of paper or media, tailgating, or interference with equipment. Draw these from the risk assessment and risk treatment records the organization already keeps under the ISMS, and note any residual risk the organization accepts. The output is a short risk rationale per room class that the Statement of Applicability can cite. Done means every class has a stated reason for its protections and the rationale is approved by the risk owner.
Define protections for each room class
Specify the controls for each class, such as locks and key control for internal rooms, card readers and access logs for restricted rooms, lockable cabinets for paper and media, discreet or unlabeled signage, screen orientation and privacy filters where screens face public areas, and rules for whiteboards and visitor escorts. Choose measures in proportion to the risk, and state which ones are technical, procedural or both. The output is a control specification per class that names the hardware, the configuration and the procedure. Done means each class has a complete specification that a facilities contractor or internal team can build against.
Assign owners and write the operating rules
Name an accountable owner for each room or group of rooms, normally a department head or facilities manager, and a control custodian who manages keys, cards and cabinet combinations. Write short rules for staff on locking practice, who may hold keys or cards, how lost credentials are reported, and when sensitive discussions must move to a suitable room. The output is an ownership register and an approved rule set that staff have read. Done means every room has a named owner and custodian, and the rules are published in a location staff can find.
Deploy, verify and record evidence
Install the specified protections, then test them. Confirm that locks and readers work as configured, that access logs capture events, that cabinets lock, and that screens and signage meet the specification. Walk each room as an assessor would, check a sample of access rights against authorizations, and log any gaps with a corrective action and an owner. The evidence set includes the room register, classifications, the risk rationale, specifications, the ownership register, configuration exports, photographs or floor plans, test records and the findings log. Done means each in-scope room has a test record and every gap is closed or formally accepted.
Evidence that passes an A.7.3 review
An auditor testing A.7.3 wants to see that the organization decided which rooms need protection, designed the protection around its own risk assessment, and keeps checking that it still works. The cards below cover the records that show those decisions and checks, who should own each one, and how to keep it current between certification audits.
Room classification register
A register that lists every office, room and facility inside the perimeter, the classification of the information it holds, and the protection level assigned to it. It is the starting point for everything else, because an assessor will pick rooms from this list and ask for the matching evidence. Review it when rooms are added, repurposed or move to a new tenant, and check that the register and the physical floor plan still agree. Facilities or the security lead typically owns it, with the information owner confirming classifications.
Facility design rationale
A short written rationale for why each room is protected the way it is, tied to the risk assessment that the organization carried out under clause 6.1.2. It should explain choices such as why a server room has a separate lock, why a meeting room near a reception desk has blinds, or why a document store sits away from public corridors. An auditor compares this rationale with the risk assessment to see whether the controls follow from identified risk or were chosen by habit. Update it whenever the risk assessment changes. Security architecture or facilities owns it.
Door and access configuration exports
Exports from the access control system showing which doors are controlled, which credentials can open them, and which schedules apply, such as after-hours restrictions on restricted rooms. Take exports on a fixed schedule and keep them with a timestamp and the name of the person who ran them, so the assessor sees a consistent history rather than a single snapshot. Compare the exports with the room register to confirm that no sensitive room is left on a default setting. Facilities or IT operations owns the system, and the security lead reviews the exports.
Visitor and key logs
Records of who entered restricted rooms, when, and under whose escort, together with a register of physical keys and their holders. Logs show whether access rules are followed in practice, and gaps in them often lead an assessor to question the whole control. Reconcile key registers against staff changes and check visitor logs against badge data at least periodically. Reception or facilities staff record the entries, and the security lead checks that the records are complete.
Signage and screen placement walkthroughs
Photographs or dated walkthrough notes showing that discreet signage is in place and that screens, whiteboards and printed documents in sensitive areas are not visible from public corridors, windows or shared spaces. A reviewer should walk the route a visitor would take and record what can be seen from it. Repeat the walkthrough after office moves, new seating plans or refurbishment, because these change sightlines without anyone noticing. The facilities team or a security staff member performs the walkthrough and files the notes.
Inspection records and corrective action tickets
Inspection records show that locks, doors, alarms and room layouts were checked on a set schedule, and corrective action tickets show what happened when a check found a problem, such as a propped fire door or a lock that no longer latched. Together they prove the control is operated, not just designed. Link each ticket to the room in the register and close it only after a re-inspection confirms the fix. The facilities manager owns the inspection cycle, and the risk owner signs off on closure of significant findings.
What meeting A.7.3 costs in money and effort
This table breaks down the cost and effort components of securing offices, rooms and facilities, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No prices are published here because none were supplied, so use the drivers and quote requests to compare offers. The main takeaway is that most of the cost sits in hardware and in the recurring staff time needed to keep evidence current.
| Cost component | Who is paid or who spends time | One-time or recurring | What drives it and what to request in a quote |
|---|---|---|---|
| Locks and access hardware | Locksmith, security integrator or facilities contractor | One-time for installation, recurring for repairs and replacements | Number of doors and rooms classed as sensitive. Ask for itemized hardware, installation and a maintenance schedule. |
| Signage and discreet labeling | Facilities team or print supplier | One-time, with occasional reprinting | Number of sites and rooms where sensitive work happens. Ask whether signage wording is reviewed by the security owner. |
| Secure cabinets and storage | Facilities or furniture supplier | One-time purchase, low recurring upkeep | Volume of paper and media that must be kept out of public view. Ask for lockable options and key or code control. |
| Facilities staff walkthroughs | Internal facilities or building management staff | Recurring, usually scheduled checks | Building count, shared space and how often rooms change use. Confirm how often checks are logged and who signs them off. |
| Evidence upkeep | Internal security or compliance owner | Recurring | Frequency of access reviews, photos, key registers and change records. Ask the implementation partner which records they set up and who maintains them afterwards. |
| Internal audit time | Internal audit or ISMS owner | Recurring, typically once per audit cycle | Size of the estate and the number of sites in scope. Confirm what the independent auditor will sample. |
| Outside walkthrough or review | Consultant or implementation partner | Often one-time for readiness, optional recurring | Scope of the written statement of work and number of sites visited. Ask for a fixed-scope quote listing sites, deliverables and dates before work starts. |
| Certification audit fees | Independent certification body | Recurring over the certification cycle | Not a cost of A.7.3 itself, but auditors sample physical controls during the audit. Request the certification body's own quote. |
Who owns A.7.3 in-house, with a partner and with the auditor
Your organization owns A.7.3 in full. Someone accountable inside the business must decide which rooms and floors are sensitive, which activities must stay out of public view, and what the rules are for locks, badges, signage and clear sightlines. Those decisions belong to you because you carry the risk if an unauthorized person reads a screen, photographs a whiteboard or walks into a records room. A partner can advise on options, but the classification and the sign-off remain internal.
- Room classification: Maintain a current list of offices, rooms and facilities that hold sensitive information, with the owner of each area named.
- Physical rules: Write and approve the rules for locks, key or badge issue, signage wording and placement, and where screens and printers may sit.
- Operation of controls: Run the locks, access cards and visitor practices day to day, and retire keys and cards when people leave.
- Records: Keep the access lists, key registers, change logs and review minutes that show the controls work over time.
- Management review: Have someone senior review incidents and exceptions, and record the decisions.
Check that each named owner can produce the current classification and the last review record without asking an outside party for them.
An implementation partner helps you prepare for the assessment. The partner can review the physical layout against your room classification, prepare the evidence pack, and organize a walkthrough so your staff can show the controls clearly. It can also turn audit observations into a remediation plan with owners and dates. The partner does not decide that a control is adequate, and it does not sign off its own design for certification purposes. Your organization makes the final choices and keeps the records.
- Design review: Compare the current layout, locks and signage against the room classification and report gaps to your team.
- Evidence pack: Assemble the rules, access lists, key registers and review records into a single index that an assessor can follow.
- Walkthrough preparation: Brief the people who will show the controls and rehearse the questions they are likely to hear.
- Gap remediation planning: Propose fixes, owners and sequence for weaknesses found in the review, for your approval.
- Independence check: Confirm the partner is not the certification body and does not plan to audit the same work.
Ask for a written scope that lists these tasks and states which decisions stay with your organization.
An independent auditor or certification body tests whether A.7.3 is in place and working. It samples rooms, checks access lists against personnel records, observes signage and sightlines, and reviews the records for reviews and incidents. The auditor reports findings as conformities or nonconformities and does not write the controls for you. If a control is weak, the auditor identifies it and the organization decides how to fix it. Certification is granted only by an accredited certification body, and ISO itself does not certify organizations.
- Sampling: The auditor selects rooms and records to test, which means your preparation cannot cover every area in advance.
- Testing: The auditor compares what it observes with your documented rules and classification.
- Findings: The auditor records nonconformities with evidence, and you respond with corrective actions.
- Independence: The auditor cannot design or implement the controls it later assesses for the same client.
- Accreditation: Confirm the body is accredited for ISO/IEC 27001 before you rely on its certificate.
Before you engage a body, check its accreditation status and ask how it handles conflicts when a partner has prepared your evidence.
Where A.7.3 usually fails and how to close each gap
Most A.7.3 findings are not missing locks. They come from rooms nobody classified, sensitive content that is visible from common areas, and evidence assembled in a rush before the assessor arrives. The cards below take these gaps one at a time, with the check that reveals each one and the fix that closes it.
No room classification
Without a register that states which rooms hold servers, network closets, payment equipment, case files or board papers, nobody can say which spaces need stronger protection. An assessor will ask how the organization decided which rooms are sensitive and who approved that decision. Fix it by listing every room or floor that holds information or assets, assigning each a sensitivity level, and linking the level to the access rules that apply. Review the register when the floor plan or the use of a room changes.
Screens and whiteboards in public view
Monitors facing a window, a glass partition or a corridor, and whiteboards with client names or system diagrams, let anyone passing by read information without entering the room. Walk the space from the public side and note what is legible at normal standing height. Fix it by repositioning screens, fitting privacy filters where repositioning is impossible, and adding a rule that whiteboards are wiped before anyone leaves the room.
Doors left open or propped
A secure room with a door held open by a bin or a wedge offers little protection, and this is one of the most common findings during site walks. Check whether doors close and latch by themselves, whether badge readers record each entry, and whether staff are told not to prop doors for convenience. Fix it with door closers and locks that fail secure, alarm contacts on sensitive doors, and a short reminder in the induction for new staff.
Unlogged visitors in shared buildings
In a building shared with other tenants, visitors may pass through reception and lift lobbies that the organization does not control. If the organization does not record who came in, when, and whom they visited, it cannot show that access to its floor was authorized. Confirm with the building operator what visitor logging already exists, agree how the organization's own floor is recorded, and keep sign-in records with the access records for the same period.
Signage that reveals sensitive functions
Door plates such as "Payments reconciliation" or "Incident response room" tell an intruder where the valuable work happens. Walk the corridors and lifts and read every sign, label and directory screen as a visitor would. Replace descriptive names with neutral room numbers on public-facing signs, keep the detailed mapping in the access system and the facilities plan, and make sure the building directory does not list restricted floors.
Evidence gathered the week before the audit
Access lists exported on the morning of the audit, or photographs of doors taken for the first time, show that the control is not operated routinely. Assessors usually ask for records across a period and check that reviews happened on schedule. Set a recurring task to export access rights, review sensitive room lists, and file site walk notes each quarter, and store them in a location with a retention rule. Ask the auditor which sample periods they will test before choosing the format.
Questions buyers ask about A.7.3
How much effort does A.7.3 take to implement?
The effort depends mostly on how many sites, rooms and facilities fall inside your ISMS scope and how much physical security already exists. A single office with badge doors, a locked server room and a documented clear desk rule needs far less work than a multi-floor site with several sensitive rooms and no written rules. Most of the effort sits in three places: deciding which rooms hold sensitive information or equipment, specifying locks, access and signage for each, and collecting records that show the rules are followed. Ask any provider to break its quote into site survey, design, implementation and evidence collection so you can see where the hours go.
Can a small team handle A.7.3 without outside help?
Yes, a small team can often handle A.7.3 internally if it has someone who understands the premises and someone who can write and maintain the rules. The work is usually physical and administrative rather than technical: confirm which rooms are sensitive, fit locks and access control, post discreet signage, set rules for screens and paper in shared areas, and keep a record of who holds keys or cards. Outside help tends to be useful for the risk-based design decisions and for organizing evidence before an audit. The organization remains responsible for its controls in either case.
Can a shared or co-working office pass an A.7.3 audit?
A shared office can pass if the organization controls the rooms it uses and can show that its sensitive areas are protected from the building's other occupants. The auditor will look at whether your own space has lockable rooms, controlled access, and screens and paper kept out of public view, even when the building provides the perimeter. Confirm in writing what the landlord or operator controls, such as reception, shared corridors, cleaning access and building security logs, and document where your responsibility starts and stops. Gaps in that shared boundary are a common point for questions.
What does an auditor walk through when testing A.7.3?
An auditor typically walks the premises with you and compares what they see with your documented design. They check that sensitive rooms are identified, that doors and locks match the access rules, that signage does not reveal what a room contains, and that screens, whiteboards and printed material are not visible from public or visitor areas. They also ask to see key or card registers, access approvals and how exceptions are handled. Prepare a room register, a current access list and a short walk-through script so the auditor can follow the design without delay.
How often does the evidence for A.7.3 need to be refreshed?
The standard does not set a fixed refresh interval for A.7.3, so your own risk assessment and policy should define it. Access lists and key or card registers should be reviewed whenever staff change roles or leave, and room layouts should be rechecked after any move, refit or new sensitive activity. Under ISO/IEC 17021-1, a certification cycle lasts three years with at least one audit in every calendar year, so the auditor will sample evidence across that period. Confirm your review schedule with your certification body before the first audit.
Can an implementation partner prepare A.7.3 evidence without issuing a certificate?
Yes. An implementation partner can help you design the rooms, rules, signage and access records, and assemble the evidence an auditor will request. It cannot issue the certificate or an audit report, because only an accredited certification body can do that. In practice, a partner's scope is written before work starts and usually covers the room register, the design decisions, the procedures and a dry-run walk-through. Confirm in the written scope which deliverables you receive, who keeps the records going forward, and that the certification body you choose is independent of the firm preparing your evidence.
What recurring costs should I expect after A.7.3 is in place?
Most recurring cost comes from keeping access records accurate and from periodic audits by an accredited certification body. Internal time goes into reviewing key and card holders, updating the room register and checking signage after changes. Audit fees are set by the certification body, so ask it for a quote based on your scope. Locks, badge systems and monitoring hardware have their own maintenance and replacement costs. A written quote should separate one-time design and fitting work from annual review, evidence upkeep and audit fees.
How DeployOpen scopes and prepares A.7.3 evidence
DeployOpen plans and documents the systems and evidence for A.7.3 under a fixed scope agreed in writing before work starts. In practice that means the organization and DeployOpen first agree which offices, rooms and facilities are in the ISMS, which of them hold information or assets that need protection, and which systems inside those rooms are in scope, such as access control servers, network closets, print devices and shared workstations. DeployOpen then prepares the technical side of the evidence: access control configuration exports, door and reader inventories where they are managed through software, screen and print settings, and a documented description of how each room is meant to be protected. DeployOpen does not issue audit reports, attestations or certificates. An independent certification body or auditor performs the assessment and makes the decision.
DeployOpen's physical security work is limited to what it can deliver inside client environments. Its engagements can cover the configuration, logging and documentation of software-driven access and monitoring systems that the client already runs, and the integration of those records into the ISMS. Locks, door hardware, signage, the layout of rooms and the handling of paper in offices are site-level physical controls that the organization owns and operates. The organization should confirm with its facilities team who is responsible for each control before scoping, and should ask any partner to state in the written scope which physical elements are excluded. Where a gap sits in building hardware or staff behavior, the honest outcome is a documented action for the organization, not a claim that a platform covers it.
