ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The ISO 27001 physical security controls are the 14 controls in Annex A Theme 7, and they are the set most teams leave until the week before the Stage 2 audit. That is a mistake, because this is the one theme where the 2022 edition quietly rearranged the furniture: one control is brand new, two old controls were folded into one, and one control that lived in the physical section for a decade moved out of it entirely.
If your Statement of Applicability was transitioned from ISO/IEC 27001:2013 rather than rebuilt, there is a good chance it still carries the 2013 shape. This guide walks through all 14 ISO 27001 physical security controls, what each one actually asks for, what changed in the 2022 edition, and the evidence an auditor will want to see. It also deals with the two arguments auditors hear most often and reject most often: “we are cloud-native” and “we have no office.”
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
ISO/IEC 27001:2022 Annex A holds 93 controls grouped into four themes: 37 organizational, 8 people, 14 physical and 34 technological. Theme 7 is the physical set. The ISO 27001 physical security controls have a scope far wider than “the office door” — it covers boundaries, entry, rooms, monitoring, environmental threats, behaviour inside secure areas, desks and screens, equipment, storage media, power, cabling, maintenance and disposal.
Here is the full list, with the 2013 control each one came from. Where the 2013 column is blank, there was no predecessor.
| Control | Title | From ISO 27001:2013 | What it is really asking |
|---|---|---|---|
| A.7.1 | Physical security perimeters | A.11.1.1 | Define the boundaries, and show they are continuous |
| A.7.2 | Physical entry | A.11.1.2 + A.11.1.6 | Control who crosses a boundary — including deliveries |
| A.7.3 | Securing offices, rooms and facilities | A.11.1.3 | Design the rooms themselves to resist access and observation |
| A.7.4 | Physical security monitoring | — (new in 2022) | Detect unauthorised physical access, continuously |
| A.7.5 | Protecting against physical and environmental threats | A.11.1.4 | Fire, flood, power, civil unrest — assessed, not assumed |
| A.7.6 | Working in secure areas | A.11.1.5 | Rules for behaviour once someone is inside |
| A.7.7 | Clear desk and clear screen | A.11.2.9 | Nothing readable left unattended |
| A.7.8 | Equipment siting and protection | A.11.2.1 | Where kit sits, and who can see or touch it |
| A.7.9 | Security of assets off-premises | A.11.2.6 | The laptop in the airport, the server in the colo |
| A.7.10 | Storage media | A.8.3.1 + A.8.3.2 + A.8.3.3 + A.11.2.5 | Media lifecycle end to end, including removal from site |
| A.7.11 | Supporting utilities | A.11.2.2 | Power, cooling and comms — and proof they are tested |
| A.7.12 | Cabling security | A.11.2.3 | Protection from interception, interference and damage |
| A.7.13 | Equipment maintenance | A.11.2.4 | Maintained to spec, by authorised people, with records |
| A.7.14 | Secure disposal or re-use of equipment | A.11.2.7 | Nothing recoverable leaves your control |
For the full Annex A picture across all four themes, start with our guide to the ISO 27001:2022 controls.
The 2013 edition had 15 controls under A.11 Physical and environmental security, and most of the ISO 27001 physical security controls you see today came straight across from it. The 2022 edition has 14 under Theme 7. That near-identical count hides three real changes, and each one leaves a specific gap in a transitioned ISMS.
| Change | What happened | The gap it leaves |
|---|---|---|
| One control is new | A.7.4 Physical security monitoring has no 2013 predecessor | Nothing in your 2013 document set was written to satisfy it |
| Two controls became one | A.11.1.2 Physical entry controls and A.11.1.6 Delivery and loading areas both map to A.7.2 Physical entry | One SoA line now has to carry badge access and goods-in |
| One control left the theme | A.11.2.8 Unattended user equipment moved to A.8.1 User end point devices, in the technological theme | Your physical security policy has an orphan clause pointing at a technological control |
A fourth change is worth noting because it pulls work into this theme from elsewhere: A.7.10 Storage media absorbed three controls from the 2013 asset management clause — removable media management, disposal of media and physical media transfer — plus A.11.2.5 Removal of assets. That is a four-into-one merge, the biggest in the theme. We cover its consequences in detail in our guide to ISO 27001 secure disposal.
The practical test for the ISO 27001 physical security controls is quick: open your SoA, find A.7.4, and look at the document it references. If that document predates October 2022, it was written for a control that did not exist yet.
These three controls work as a sequence, and auditors test them as a sequence. A.7.1 asks you to define perimeters around areas that hold information or information processing facilities. The word that does the work is defined — a floor plan with the boundaries drawn on it is better evidence than any policy paragraph. Auditors look for continuity: a perimeter with a fire door that opens from the outside, an unsecured riser cupboard, or a suspended ceiling that runs over a partition wall is not a perimeter.
A.7.2 governs who crosses those boundaries. Expect to show an authorisation process, a visitor log, escorting rules, and a leavers process that actually revokes badges. The most common finding here is not the badge system — it is the reconciliation: a quarterly comparison of active badge holders against the HR leaver list, with the differences investigated and closed out.
A.7.3 is about the rooms. Can a sensitive screen be read from a public corridor? Is the server room signposted? Are internal walls full-height? Is the key-holder list current? This is where the ISO 27001 physical security controls stop being paperwork and become a walk-around with a notebook.
Because A.7.2 absorbed the 2013 delivery and loading areas control, a physical entry procedure that only covers reception and badge readers now answers roughly two thirds of its control. Of all the ISO 27001 physical security controls, this is the one most often half-answered. Delivery and loading points are an entry route that bypasses reception by design, and they are routinely staffed by people who are not your employees. ISO/IEC 27002 guidance for this control expects access to delivery areas to be restricted, deliveries to be inspected and registered, and incoming material to be segregated from the areas it could reach.
If you occupy part of a managed building and the landlord runs goods-in, that is not an exclusion — it is a supplier requirement. It belongs in your supplier security arrangements under A.5.19 to A.5.22, and the evidence is a clause in the lease or facilities agreement, not a sentence in your own procedure.
This middle block is where the ISO 27001 physical security controls shift from structure to behaviour. A.7.4 Physical security monitoring is the new one, and it is the only control in this theme that a 2013-era document set cannot possibly cover. It asks for continuous monitoring of premises for unauthorised physical access — alarms, intruder detection, guards, CCTV, or some combination sized to your risk. CCTV brings privacy obligations with it, which is why we treat it separately in our guide to ISO 27001 physical security monitoring.
A.7.5 asks you to protect against physical and environmental threats. Note the 2022 title change: the 2013 control said “external and environmental”. The expectation is that threats such as fire, flood, seismic activity, power failure, vandalism and civil unrest are considered against the actual location, and that the protection is proportionate to what is at risk there. A risk assessment that says “fire — smoke alarms fitted” for a building that sits on a floodplain is the finding.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
A.7.6 covers working in secure areas: who knows the area exists, what may be taken in and out, whether recording devices are permitted, and whether unsupervised working is allowed. A.7.7 is clear desk and clear screen, which sounds trivial and generates more minor nonconformities than almost anything else in the theme; our clean desk policy guide covers the rules that survive an unannounced walk-around.
A.7.8 Equipment siting and protection and A.7.9 Security of assets off-premises are the pair that most often get collapsed into one line. They are not the same question. A.7.8 is about equipment inside your perimeter — overlooking, tampering, eating and drinking near kit, environmental monitoring in plant rooms. A.7.9 is about everything you own that sits outside it: laptops in transit, home-office equipment, kit in a third-party data centre, devices at customer sites.
This group is where the ISO 27001 physical security controls meet facilities management, and where an information security team usually has to borrow evidence from someone else.
A.7.10 Storage media now carries the whole media lifecycle: classification-appropriate handling, transport, authorisation to remove media or equipment from site, and secure disposal. A.7.11 Supporting utilities covers power, cooling, water, sewage and telecommunications — the auditable part is almost always the testing, so dated generator run records, UPS battery test results and maintenance certificates are the evidence, not the equipment itself.
Of the ISO 27001 physical security controls, A.7.12 Cabling security is the one people think does not apply to them until they look at a patch panel in an unlocked comms cupboard shared with a cleaner’s store. A.7.13 Equipment maintenance asks for maintenance at the intervals the supplier recommends, by authorised people, with records — including what happened to any data on equipment that left for repair. A.7.14 Secure disposal or re-use closes the loop on hardware.
| Control | Evidence an auditor typically asks for | Usual owner |
|---|---|---|
| A.7.1 / A.7.3 | Annotated floor plan showing perimeters and secure areas | Facilities |
| A.7.2 | Access authorisation records, visitor log, badge-to-leaver reconciliation, goods-in procedure | Facilities / HR |
| A.7.4 | Alarm or CCTV system records, response procedure, retention and privacy assessment | Security / Legal |
| A.7.5 | Location-specific threat assessment and the protections it drove | Risk owner |
| A.7.6 / A.7.7 | Secure area rules, signed acknowledgements, walk-around check records | ISMS manager |
| A.7.8 / A.7.9 | Asset register with location, off-site asset authorisations, data centre contract | IT |
| A.7.10 / A.7.14 | Media register, removal authorisations, destruction certificates reconciled to the asset inventory | IT |
| A.7.11 / A.7.12 / A.7.13 | Generator and UPS test records, cabling inspection, maintenance schedule and certificates | Facilities |
This is the single most common attempt to shortcut this theme, and it fails for a structural reason. Clause 6.1.3 requires the Statement of Applicability to give a justification for every control you exclude. “Not applicable — we use AWS” is not a justification; it is a description of where the control is performed. The ISO 27001 physical security controls remain necessary; they are simply operated by somebody else, and the standard expects you to say so and to show how you assure it.
| Scenario | Wrong SoA entry | What an auditor accepts |
|---|---|---|
| Production runs entirely in a public cloud | A.7.1–A.7.6 excluded, “no data centre” | Applicable; operated by the provider; assured through A.5.19–A.5.23 and the provider’s current certification or audit report |
| Office is in a serviced or managed building | A.7.2 excluded, “landlord controls entry” | Applicable; shared responsibility documented; landlord obligations in the lease; your own badge issuance and visitor rules on top |
| Fully remote company, no office at all | Whole theme excluded | A.7.7, A.7.9 and A.7.10 apply to home workers and their equipment; the rest excluded with the scope boundary as the justification |
| Colocated hardware | A.7.5, A.7.11, A.7.12 excluded | Applicable; evidenced by the colo provider’s certification and your contracted service levels |
Getting these entries right is a Statement of Applicability problem as much as a security one — see our guide to the ISO 27001 Statement of Applicability for how to word an exclusion that survives Stage 1.
Hybrid work does not shrink the ISO 27001 physical security controls; it distributes them. Three controls travel with the person: A.7.7 clear desk and clear screen, A.7.9 security of assets off-premises, and A.7.10 where removable media is involved. A fourth sits beside them in a different theme — A.6.7 Remote working, which replaced the 2013 teleworking control and expects you to define security measures for the remote working site itself.
That split matters for your document set. A home-working annex that only covers VPN and device encryption is answering A.8.1 and A.6.7 and leaving the physical requirements unevidenced. The practical fix is three lines in the remote working policy: where equipment may be used and stored, what must not be visible or audible to household members and visitors, and how equipment is returned or disposed of. Our guide to ISO 27001 remote working covers the rest of A.6.7.
Working through the ISO 27001 physical security controls in control-number order wastes effort. Work outward from what you can see.
Two practices make the difference between a clean audit of the ISO 27001 physical security controls and a pile of minor findings. The first is a recorded walk-around — a short, dated checklist completed monthly or quarterly covering clear desks, unattended visitor badges, propped doors and unlocked comms cupboards. The second is keeping facilities evidence inside the ISMS rather than in a facilities shared drive nobody can find during the audit.
Fourteen. The ISO 27001 physical security controls sit in Theme 7, and Annex A of ISO/IEC 27001:2022 contains 93 controls across four themes — 37 organizational, 8 people, 14 physical and 34 technological. The physical set is numbered A.7.1 to A.7.14.
A.7.4 Physical security monitoring. It is one of 11 new controls introduced in 2022 and the only new one in this theme, so it has no 2013 predecessor and no legacy document behind it. Organizations that transitioned before the 31 October 2025 deadline sometimes mapped it to an existing CCTV note rather than writing the control up properly.
Not as a block. A fully remote organization can usually exclude the perimeter, entry, secure area and utilities controls on the grounds that there is no site within scope, but A.7.7 clear desk and clear screen, A.7.9 security of assets off-premises and A.7.14 secure disposal still apply to company equipment in people’s homes. Each exclusion needs its own justification in the Statement of Applicability under clause 6.1.3.
The ISO 27001 physical security controls apply to you; the provider performs some of them on your behalf. You evidence that through supplier security controls A.5.19 to A.5.23 — typically the provider’s own ISO/IEC 27001 certificate or a current assurance report, reviewed at a defined frequency, plus the contracted obligations. Marking the controls “not applicable” because the data centre is somebody else’s is the entry auditors push back on.
None of the ISO 27001 physical security controls name a mandatory document, and ISO/IEC 27001:2022 does not require a physical security policy by name. In practice an auditor expects a documented physical and environmental security policy or procedure, an annotated site plan, a visitor and access authorisation record, secure area rules, a clear desk and clear screen rule, and maintenance, testing and disposal records. The records matter more than the policy; a well-written policy with no walk-around evidence behind it is a finding waiting to happen.
The ISO 27001 physical security controls reward a site walk more than a reading session. Take the floor plan, walk every entrance including the loading bay, and write down what you actually see — then compare that against your Statement of Applicability. The gaps will be obvious within an hour. The full requirement text sits in ISO/IEC 27001:2022 on the ISO website (Edition 3, published October 2022), with the implementation guidance in ISO/IEC 27002:2022.
If you would rather start from drafted documents than a blank page, our ISO 27001 Toolkit includes 165 templates that map to the ISO 27001 physical security controls and the rest of Annex A, covering the physical and environmental security policy, secure area rules, visitor and access records, asset and media registers and the Statement of Applicability, for $99.
October 21, 2026
October 21, 2026
October 20, 2026
October 20, 2026
October 19, 2026