A.7.6 Working in secure areas: requirements and evidence

What A.7.6 working in secure areas asks for in plain words

When an auditor asks how staff behave inside a server room or restricted floor, they want to see that you have designed and implemented security measures for work done in those areas. A.7.6 Working in secure areas asks the organization to protect the information and assets inside a secure area from damage and unauthorized interference by the people working there. The control is not about who can open the door. It is about what people do once they are inside, including staff, contractors, cleaners and maintenance workers. The risk is wider than deliberate misconduct. A person working in a secure area can cause harm by accident, by leaving equipment unattended, by propping open a cabinet or by plugging in an unknown device. Unsupervised work in a restricted space can go unnoticed for hours. Personal phones, cameras and other recording devices can capture screens, racks, labels or documents that should never leave the room. Each of these is a plausible route to damage or disclosure, and an auditor will expect you to have named them in your rules. The control is hard because the rules sit between facilities, HR and IT. Facilities usually owns the doors and the escort arrangements, HR owns the contracts and the discipline process, and IT owns the systems inside the room. A.7.6 has to be written as one set of rules, communicated to everyone who enters, and then checked. Ask who signs off each rule, how contractors receive it before their first visit, and what record shows that a given person was told. The written policy is only the first piece of evidence, and the assessor will look for the rest.

Whether a rule is actually followed is the question that decides the audit. Confirm which access logs, visitor records, supervision notes and spot-check results you can produce for a sample of recent entries, and who reviews them. Confirm also how your rules on recording devices and unsupervised work are enforced at the door, not only described in a document. Your organization owns these controls. An implementation partner or consultant can help you define the rules, prepare the records and test the checks, but only an independent auditor or certification body can judge whether the control meets the standard. The 2013 edition covered similar ground under A.11.1.5 Working in secure areas. ISO/IEC 27002:2022 Annex B traces A.7.6 to that earlier control, so an existing 2013-based control set can be mapped forward rather than rebuilt from nothing. Read the ISO/IEC 27002:2022 entry on the IEC Webstore for the control guidance, and check the sibling controls A.7.2 Physical entry and A.7.3 Securing offices, rooms and facilities, because the entry records and room rules they produce are the evidence A.7.6 relies on.

Which areas, people and third parties A.7.6 covers

A.7.6 applies only to the secure areas the organization has defined inside its own ISMS scope, so the first job is deciding which rooms count and who works in them. The cards below cover the decisions that change the rule set, the people an auditor will expect to see covered, and how the rules connect to the perimeter and entry controls around those rooms.

Defining which rooms are secure areas

A secure area is any space where the organization's information or information processing assets sit and where a working-rule set is needed. Typical candidates are data centers, network and comms rooms, records storage, and cash or card handling rooms. Each candidate should be listed in the asset inventory and tied to the ISMS risk assessment, so the auditor can trace why a room is in or out. Ask whether a room with a single rack or a paper archive has been considered, since small spaces are often missed.

Covering staff, cleaners and contractors

The rules must reach everyone who works inside a secure area, not only employees. Cleaners, facilities staff, building contractors and vendors on maintenance visits all need to know the entry window, supervision requirement and device limits that apply to them. Confirm how each group is briefed and whether the contract or visitor process carries the rules to third parties who are not on the payroll.

Linking to perimeter and entry controls

A.7.6 works after the outer controls. The perimeter defined under A.7.1 decides where secure areas begin, and the entry controls under A.7.2 decide who gets through the door and when. If those controls are weak or unlogged, the working rules inside have little to rely on. Check that the entry records and the working-rule list refer to the same room names and access groups.

Vendor maintenance and remote access

Vendors who service servers, storage, power or cooling often work in secure areas for short periods. Their visits should be scheduled, escorted where the rules require it, and recorded. Remote administration into equipment that sits in a physical room still raises questions about who is on site at the other end, so confirm how remote sessions are linked to a physical location in the scope.

Cloud-hosted equipment and retained spaces

Many organizations run workloads in a cloud provider's facilities but keep a physical space, such as a server cabinet, network closet or office with a document safe. The cloud provider's data center controls are generally inherited through its own assurance reports, but the organization's own rooms still need A.7.6 rules. Decide which cloud-hosted items fall in scope, document the boundary, and confirm with the provider what evidence it can supply.

Tying scope to the ISMS scope statement

The list of secure areas is not a free choice made for the audit. It follows from the organization's own ISMS scope, which the certification body reviews. If a room, site or service is excluded from scope, the A.7.6 rules for it may not be assessed, and the exclusion needs a stated reason. Confirm that the scope statement, asset register and A.7.6 list were updated together after the last change.

How an assessor tests working in secure areas

This table sets out each step an assessor takes to test A.7.6, the evidence requested at each step, and the findings that most often lead to nonconformities. Read it as a test plan: the organization should prepare the same records before the audit that the assessor will ask for during it.

Test step	What the assessor does	Evidence the assessor expects
Review the written rules	Reads the secure area rules and checks they state who may enter, when, under what supervision, and what is banned inside.	Approved secure area policy or procedure with owner, version and review date
Check communication and acknowledgment	Confirms staff and contractors were told the rules and that the rules are current, not only published.	Training records, signed or electronically recorded acknowledgments, induction content
Walk the secure areas unannounced	Observes the work in progress: who is present, whether anyone is unescorted, and whether cameras or recording devices are in use.	Observation notes, photos taken by the assessor where permitted, and the site's own walk records
Sample access and supervision records	Picks a sample of dates and tasks and traces them back to a named escort, a time window and an authorized person.	Badge or access logs, visitor and contractor sign-in sheets, escort assignment records
Review camera or badge data	Checks whether recorded data supports the logs, especially for out-of-hours work and unsupervised periods.	Camera retention settings, badge event exports, documented review or spot-check results
Check exception approvals	Looks for any work done outside standard rules and confirms someone with authority approved it in advance.	Dated exception requests, approver names, compensating controls and expiry or closure records
Interview staff and contractors	Asks people inside the secure area what they do, what they are allowed to bring in, and what they do when left alone.	Interview notes that match the written rules and the logs, not only a recital of policy

Implementing secure area working rules in order

This sequence turns A.7.6 from a policy statement into working rules that people follow, supporting controls that enforce them, and records an auditor can sample. Each step ends with an output you can show as evidence.

Define which areas count as secure
Start by listing the rooms, floors, cages and racks where information or assets are processed or stored and where extra working rules apply, such as data centers, network closets, records rooms and secure development labs. The owner of the physical security function, usually with facilities and the information asset owners, signs off the list. Done means a dated register of secure areas, each with a named owner and a reference to the physical security perimeter it sits behind. An auditor will compare this register with floor plans and badge configuration, so the boundaries must match what the building actually has.
Identify the work performed inside each area
For each secure area, record the activities that happen there: routine operations, maintenance by staff or contractors, deliveries, installation work, audits and incident response. Note which work can be done alone and which needs a second person present. Owners of each area and the facilities team complete this with the people who actually do the work, not only from the policy. Done means an activity matrix per area. Auditors often ask how the rules were derived, and this matrix shows that the rules follow real risk rather than habit.
Write the working rules for secure areas
Draft the rules that cover who may enter and when, the supervision required for visitors and contractors, limits on cameras, phones and other recording devices, what may and may not be carried in, and when unsupervised work is allowed. The information security function drafts the rules with physical security and the area owners, then management approves them. Done means an approved, version-controlled working rules document. Write the rules so each one can be checked, for example a stated rule that recording devices are not allowed in a named area is easier to test than a general instruction to be careful.
Set the approval path for exceptions
Define who can approve access for a person or a task that falls outside the standing rules, such as a contractor needing an unsupervised night visit or a vendor bringing a camera to photograph equipment. Name the approver for each area and the minimum information they need, including purpose, duration and supervising person. Done means a written approval procedure and an exception log template. Auditors sample exceptions to confirm they were approved before the work happened, so the approval record needs a date, approver and the reason.
Communicate the rules and collect acknowledgments
Publish the rules to employees, contractors and regular visitors, and brief the people who work in or enter secure areas before they gain access. Ask each person to acknowledge the rules, and keep the acknowledgment with their access record. Vendors and contractors need the same obligations written into their contracts or site rules. Done means a list showing who received the rules, when, and their signed or electronically recorded acknowledgment. Auditors commonly sample people who have access and ask to see this record, so the list should be kept current when roles change.
Configure supporting controls
Make the rules enforceable through the systems that already exist. Align badge and access control scopes with the authorized list so that only approved people can enter each area and at the approved times. Confirm that camera coverage covers entries, workspaces and the supervised paths, and that monitoring records are retained as the policy requires. Where phone or device restrictions apply, agree how they are enforced, such as lockers at the door or signage with spot checks. Done means configuration exports from the access control and monitoring systems that match the register and rules, plus a note of any gap with a remediation owner. Confirm the capabilities of your specific access control and camera products with their vendors before relying on them.
Run a first walk-through and check the rules
Carry out a supervised walk-through of each secure area with the area owner. Compare what happens on the floor with the written rules: whether people are signed in, supervised, carrying only allowed items, and whether any unauthorized device is visible. Record each observation, the person who observed it and the corrective action with an owner and a target date. Done means a signed walk-through report and a corrective action log. This is the first piece of evidence that the rules operate in practice, so record exceptions honestly rather than correcting them quietly before the record is made.
Record the outcome and schedule the next review
Close the sequence by summarizing the results in the control record: the rules version, the area register, the acknowledgment rate, configuration exports, the walk-through results and open corrective actions. Set the review cycle and the triggers for an earlier review, such as a change to the site, a new tenant or a security incident. Management or the ISMS owner should review and accept the record. Done means a control record that links each piece of evidence to A.7.6 in your Statement of Applicability. The independent auditor decides whether the control is effective; your record is what they will test.

Why secure area rules fail in practice

Secure area rules usually fail in the gap between the written policy and what people do on an ordinary Tuesday. The most common failure is that the people who most need the rules never received them. Contractors, cleaners, facilities staff and temporary workers often work inside a secure area without ever seeing the policy, and nobody checks whether the rule was communicated before access was granted. Camera and phone restrictions fail in a similar way: the prohibition appears in a handbook, but there is no sign at the door, no check at the entrance, and no one who notices when a device is raised in a server room. Supervision fails when it depends on one named person who is often absent, on leave or reassigned. When that person leaves, the arrangement quietly stops, and no one has been told to take over.

The Statement of Applicability is where an assessor starts tracing the control, so the entry for A.7.6 Working in secure areas should state the reason the control applies and point to the rules that implement it. Confirm that the entry names the specific secure areas in scope, such as a data hall, a card-processing room or a records store, and that the rules for each area are traceable to the risk assessment that justified them. A useful test is whether a reader can move from the SoA entry to the written rules, to the people who were told about them, and to a record that shows they were. If any link is missing, the justification for the control is weak even when the rules themselves are sound.

Before the next assessment, ask who in your organization can actually name the rules for a given secure area, and who is responsible for reviewing supervision arrangements when a supervisor changes role. Confirm with your auditor which records they expect for contractors who enter secure areas, since acknowledgment records and access records are often kept in different systems. Treat the SoA entry as a living statement that must match practice, and revisit it whenever a secure area is added, a supplier starts work on site or a supervisor is replaced.

Evidence that passes an A.7.6 review

An auditor testing A.7.6 Working in secure areas wants to see that the rules exist, that people know them, and that the rules were followed in practice. The six artifacts below answer those three questions, and each needs a named owner and a review date so it stays current between audits.

Written secure area working rules

The rules document sets out who may enter a secure area, when, what work is permitted, and what happens when someone breaks the rules. Keep a version history with the approver, the date of each change and the reason for it. Check that the rules match the secure areas actually listed in your physical security scope, because an auditor will compare the two. Assign an owner, usually the physical security or facilities lead, and set a review date at least once a year and after any change to the site.

Signed acknowledgments and training records

Each person who works in a secure area, including contractors and cleaning staff, should have a dated acknowledgment of the working rules and a record of completed training on them. Store these in your HR or learning system and tie them to the access grant, so a person without a current acknowledgment cannot be issued entry. Check the records against the current rules version, not an older one, and confirm that new joiners and contractors are covered before their first entry.

Supervision and escort logs

Where visitors, vendors or staff without clearance work inside a secure area, the log should record who was escorted, by whom, the entry and exit times, and the purpose of the visit. Auditors often sample these logs against badge or door records to see whether the logged supervision matches actual movement. Ask the facilities or security team to reconcile the log weekly or at each visit, and name the person who reviews it.

Authorization lists for entry

Maintain a current list of individuals authorized to enter each secure area, with the business reason, the approver and the date of grant or removal. Remove people who change roles or leave, and check the list against the directory or identity system so that departed staff do not keep standing access. Review the list at a fixed interval set by the control owner, and keep the signed review as evidence that the list was checked.

Approved exceptions for recording and unsupervised work

Where your rules restrict cameras, phones, audio recorders or unsupervised work in a secure area, record every approved exception with the requester, the justification, the time window, the controls applied and the approver. The exception is only evidence if it is bounded, so confirm that expired exceptions are closed and that anyone working alone had a documented reason. Auditors frequently ask to see exception records alongside the rules they override.

Periodic walk-through reports

A dated walk-through of each secure area by a security or facilities reviewer shows that the rules are checked in practice. The report should note what was observed, such as unescorted visitors, devices in use, or doors propped open, and the corrective action with an owner and due date. Walk-throughs at a set frequency, with follow-up on each finding, give an auditor a trail from observation to remediation. Confirm the frequency with your own risk assessment and your certification body.

What meeting A.7.6 costs in money and effort

This table breaks the cost of working-in-secure-areas rules into components, showing who does the work, whether each cost is one-time or recurring, and what pushes it up or down. Use it to structure a quote request or an internal budget, since no supplied figures set prices or hours for these components. The main takeaway is that most of the cost is internal staff time, and recurring supervision and access administration usually outweigh the one-time drafting work.

Cost component	Who is paid or spends time	One-time or recurring	What drives it up or down
Written secure area rules and annual review	Information security, facilities and HR staff; legal review if contracts require it	One-time drafting, recurring review	Number of distinct secure areas; consolidating areas into one standard rule set lowers effort
Communication and training	Internal trainers or an external provider; staff time for attendance	One-time rollout, recurring for new joiners and contractors	Headcount turnover and contractor volume; folding the rules into existing onboarding lowers cost
Access list and badge administration	Facilities or security operations staff; access system administrators	Recurring	Number of people with secure area rights, shift patterns, and how fast leavers are removed
Supervision and escort time	Security guards, reception or staff who escort visitors and contractors	Recurring, often the largest item	Hours of unsupervised access allowed, out-of-hours work, and visitor or contractor volume
Photography and recording device controls	IT or facilities staff to set rules, lockers or signage; guards to enforce	One-time setup, recurring checks	Whether cameras or phones are already restricted by existing systems; newly installed controls add cost
Periodic walk-throughs and spot checks	Information security or internal audit staff	Recurring, usually on a set schedule	Number of secure areas, and how often the organization chooses to test them
Records of access and supervision	Security operations staff; storage for logs or sign-in sheets	Recurring	Whether records come from an existing access control system or are kept by hand
Independent auditor sampling	Certification body or auditor, with staff time to produce records	Recurring at each audit cycle	Number of sites, scope of the ISMS, and how well records are already organized
Outside implementation support	Implementation partner for rule drafting, evidence design or walk-through preparation	Usually one-time, with optional retainers	Fixed-scope written agreement; request a quote that lists the areas, sites and deliverables covered

Who owns A.7.6, who can help, and where the auditor stops

The organization owns A.7.6 in full. Facilities and security teams usually write and enforce the rules for working in secure areas, while HR and system owners decide who needs access and keep the records that show it. Responsibility sits with named people, and the rules only work if those people run them day to day.

Facilities and security: Define which rooms count as secure areas, set supervision rules, and decide how cameras, phones and recording devices are handled inside them.
HR and contractor managers: Confirm that staff and contractors who work in secure areas have been told the rules and have acknowledged them before access starts.
System and asset owners: Decide which unattended jobs or remote sessions are allowed and record who runs maintenance or monitoring inside these areas.
Access administrators: Keep the authorization and removal records that an auditor will sample against the stated rules.
Management: Approve the rules, set the review cycle, and make sure exceptions are recorded and reviewed.

Before any outside party is engaged, confirm that each rule has a named owner and that each owner can produce the records the rule creates.

Gaps that cause A.7.6 findings and how to close them

Most A.7.6 nonconformities come from rules that exist on paper but do not reach everyone who works in a secure area, or from records that cannot show the rules were followed. The gaps below are the ones auditors most often find, and each one pairs a closing action with the evidence that proves it is closed.

Rules not extended to contractors and cleaners

Secure area rules are often written for employees, while cleaners, facilities staff, building contractors and visiting engineers work in the same rooms under looser habits. A.7.6 covers anyone working in the area, so the organization must decide which rules apply to each group and brief them before they enter. Check that contractor agreements or site induction materials name the secure area rules, and that the cleaning contractor has signed the same rules. The evidence is a signed acknowledgment per external party and the induction record.

No record of who was escorted

When a non-authorized person enters a secure area with an escort, the organization needs to show who escorted them, for how long, and what supervision applied. Without that record, an auditor cannot verify that supervision happened. Confirm that visitor logs capture the escort's name, the visitor's name, time in and time out, and the area visited. The evidence is a complete visitor and escort log that can be sampled against badge or door records.

Device rules without enforcement

Policies often prohibit cameras, phones and recording devices in secure areas, but nothing at the door checks for them. A.7.6 expects limits on photographic and recording devices to be applied in practice. Confirm where devices must be stored, whether lockers or a holding point exist, and how exceptions are approved. Spot checks, signage at the entrance, and a documented exception process give the auditor something to test. The evidence is the signed device rule, the locker or holding procedure, and the exception register.

Outdated authorization lists after staff changes

Access lists for secure areas often lag behind staff movements. People who changed roles, left the organization or moved to another site keep access they no longer need, and nobody notices because the list is reviewed rarely or not at all. Tie the list to the joiner, mover and leaver process and set a recurring review by the area owner. The evidence is the dated authorization list, the review sign-off, and the removal tickets that match leavers from HR records.

No evidence of walk-throughs

Many organizations believe supervision and rule compliance happen, but cannot show anyone checked. Periodic walk-throughs by a security or facilities owner create that proof, especially when they record what was observed and what was corrected. Agree the frequency and the checklist in advance, and make sure findings go to an owner with a due date. The evidence is a dated walk-through checklist, photographs or notes where permitted, and the follow-up actions closed in the register.

Questions buyers ask about A.7.6

Can we implement A.7.6 working in secure areas in-house?

Yes, in most organizations the control is owned and run by the organization itself, and an in-house team can write the rules, brief staff and keep the records. What the organization must own is the decision about who may enter secure areas, when, under what supervision, and which devices are allowed. A partner can help draft the procedure and test the setup, but the rules must be approved, communicated and enforced by the organization. The practical question is whether your facilities, HR and security staff can keep the access records, supervision logs and spot checks current for the whole certification cycle, because an auditor will test the control as it operates, not as it was written.

How much effort does A.7.6 take, and what drives it?

The effort depends mainly on how many secure areas exist, how many people and third parties enter them, and how many rules already exist in your current physical security procedures. The fewer secure areas and the more consistent your existing entry records, the less work remains. Effort rises with contractors who work unsupervised, with the number of sites, with recording devices that must be controlled, and with the amount of evidence you must produce on request. No fee or duration is stated here because none has been supplied for this control. Ask any quote to break effort into scoping, procedure writing, staff briefing, tooling and evidence collection, and to say which items recur each year.

How long does it take to get A.7.6 evidence in place?

The timing depends on whether the rules already exist in writing and whether access to secure areas is already logged. If both are in place, the remaining work is mostly to align the rules with the control, brief the people involved and collect a period of records that shows the rules working. If neither exists, the organization must first define the secure areas, then write and approve the rules, then run them long enough to produce records an auditor can sample. No duration is given here because none has been supplied. Ask a partner to state which evidence will exist on the day of the audit and how many weeks of records that will require, based on your environment.

What must our team provide to an implementation partner?

A partner can only prepare evidence for the control if it can see how your secure areas really operate. Provide a list of secure areas and their purpose, your current access and visitor procedures, the current supervision arrangements for contractors and cleaners, the policy on phones, cameras and recording devices, and the systems that hold entry or badge records. Also provide the names of the people who own each process, and any existing risk assessment for the sites. Share samples of recent access records and incident reports so the partner can judge gaps. Sensitive material should be shared under your confidentiality terms, and access should be limited to what the engagement requires.

Can a partner sign off that A.7.6 is met?

No. A partner can prepare the procedures, configure the logging, test the controls and assemble the evidence, but it cannot sign off that the control is met. The organization owns its controls and decides whether they operate, and only an independent auditor or certification body issues an assessment outcome or certificate. Be cautious with any proposal that promises a sign-off or guaranteed result. A useful partner will tell you which evidence an auditor will ask for, how the rules are checked, and which items remain your responsibility after the engagement ends.

Can self-hosted open-source tools record secure area access?

Self-hosted open-source tools can help with parts of this control, such as centralizing logs from door controllers, badge systems or video recorders into a log store that you run in your own infrastructure, and keeping authorization lists under version control. Whether a particular tool can integrate with your physical access hardware is a question to confirm with the vendor and the equipment manufacturer, because physical access systems often use proprietary interfaces. Tools cannot replace the human rules, such as supervision of unsupervised visitors or the policy on recording devices. Ask for a demonstration that produces the exact records an auditor will sample, including who entered, when, under whose authority and who escorted them.

How does A.7.6 differ from A.7.2 and A.7.3?

A.7.6 governs behavior inside secure areas: who may work there, when, under what supervision, and what devices may be used. A.7.2 Physical entry covers the access points into those areas, including visitor handling, delivery and loading, and the authorization records reviewed at entry. A.7.3 Securing offices, rooms and facilities covers protection of spaces inside the perimeter, such as locks, discreet signage and keeping sensitive activity out of public view. The three controls overlap in practice, because the same badge log can support entry and working rules. Auditors usually test them together, so map each rule and record to the control it supports before the audit begins.

How DeployOpen prepares A.7.6 evidence

DeployOpen helps organizations prepare the systems, procedures and records behind A.7.6 Working in secure areas, inside the client's own infrastructure. The organization owns its controls and decides who may enter secure areas and when, while DeployOpen prepares the supporting evidence for an independent certification body to review.

How we scope

Agree in writing which secure areas, rooms and systems the A.7.6 work covers before any work starts.
Confirm which roles, contractors and visitor types work inside secure areas and need supervision rules.
Record which recording devices, unsupervised work cases and monitoring tools are in or out of scope.

How we build

Configure access and visitor logging tools in the client's environment so that entry and work records can be produced on request.
Draft working-in-secure-areas procedures that match the organization's own risk assessment and classification rules.
Set up camera, device and supervision checks that show whether the rules are followed in practice.

How we hand over

Deliver the written procedures, configuration records and sample evidence packs with an owner and review date for each.
Document how staff and contractors were told about the rules and how acknowledgements are stored and retrieved.
Walk the client's own assessors through where each piece of evidence lives so they can answer questions during audit.

How we support

Offer ongoing support and upgrades for the tools and logs that record secure area access, available as a retainer.
Review procedures and evidence samples when the organization changes sites, suppliers or working arrangements.
Confirm with the certification body which evidence format and sampling it expects before final handover.