ISO 27001:2022 Annex A Control 7.1

Guidance on ISO 27001:2022 Annex A 7.1

ISO 27001:2022 Annex A 7.1 guarantees an organisation can show it has suitable physical security boundaries in place to stop unauthorised physical access to information and other related assets.

This entails taking steps to preclude:

• Unauthorised entry into buildings, rooms, or areas containing information assets is prohibited.
• The removal of assets without permission from the premises is unacceptable.
• The unauthorised utilisation of premises assets, such as computers and related devices, is not permitted.
• Unauthorised tampering with electronic communication equipment, such as telephones, faxes and computer terminals, is not allowed.

It is possible to implement physical security perimeters in two different ways:

Physical access control – safeguards entry to facilities and buildings and movement within them. This includes locking doors, alarms, fences and barriers.

Hardware security – provides control over physical equipment, such as computers, printers and scanners, that process data containing sensitive information.

This control helps safeguard information and other related assets, such as confidential documents, records, and equipment, by preventing unauthorised use of facility space, equipment, and supplies.

What’s Involved and How to Meet the Requirements

Guidelines to be taken into account for physical security perimeters should be adopted where feasible:

• Establishing security barriers and pinpointing the exact location and strength of each in line with information security regulations concerning the resources within the boundary.
• Ensuring the physical security of a building or site that houses information processing systems is vital, with no gaps or weak points in the perimeter where a break-in could be facilitated.
• The exterior surfaces of the site, including roofs, walls, ceilings, and flooring, must be of sturdy construction and all external doors should be outfitted with control mechanisms like bars, alarms, and locks to prevent unauthorised entry.
• Ensure windows and doors are locked when unoccupied and consider external security for windows, especially on the ground floor; ventilation must be taken into account too.

For further insight into what is expected for compliance with the ISO 27001:2022 standard, consult the associated documentation.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 7.1 replaces ISO 27001:2013 Annex A 11.1.1; the context and meaning remaining largely similar, albeit phrased differently.

The 2022 version saw a reduction in implementation requirements compared to the prior control.

Annex A 7.1 lacks the requirements detailed in Annex A 11.1.1, which are as followed:

• There should be a staffed reception area or another way of managing physical entry to the site or building.
• Only authorised personnel should be permitted entry to sites and buildings.
• Construct physical barriers, when applicable, to impede unauthorised physical access and avert environmental contamination.
• Installing intruder detection systems that meet national, regional, or international standards and testing them regularly to secure all external doors and accessible windows is necessary.
• All unoccupied areas should be fitted with an alarm system at all times.
• We should ensure coverage of other areas, such as computer and communications rooms.
• The organisation should keep their information processing facilities physically separated from those managed by external sources.

No omission reduces the effectiveness of the new ISO 27001:2022 standard; instead, they were eliminated to make the control easier to use and understand.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

Who Is in Charge of This Process?

The Chief Information Officer (CIO) is the leader responsible for safeguarding company data and systems. They work with other executives to consider security when making business decisions, such as the Chief Financial Officer and Chief Executive Officer. Implementing policies and procedures to protect the company’s information is a key part of the CIO’s role.

The Chief Financial Officer has a role in deciding on physical security perimeters. Working with other C-suite executives, including the CIO, they decide how much to invest in physical security measures such as surveillance cameras, access controls and alarms.

What Do These Changes Mean for You?

ISO 27001:2022 is not a major overhaul, so no significant alterations are necessary for compliance.

It is worth examining your current implementation to guarantee it is in line with the new requirements. Particularly, if any changes were made since the version of 2013. It is worth re-assessing those changes to determine if they remain valid or need to be altered.

How ISMS.Online Help

ISMS.online can assist in proving ISO 27001 compliance by providing an online system that enables storage of documents in a single, accessible location. It also facilitates development of checklists for each document, thus facilitating review and modification of documents.

Would you like to experience how it works?

Contact us today to reserve a demonstration.