ISO 27001:2022 Annex A Control 7.2

What Is the Purpose of ISO 27001:2022 Annex A 7.2?

ISO 27001:2022 Annex A Control 7.2 guarantees only authorised physical access to the organisation’s data and other related assets.

Physical security is paramount for safeguarding the confidentiality, integrity and accessibility of information resources. Annex A Control 7.2 of ISO 27001:2022 is primarily concerned with preserving data and other related assets from unauthorised access, theft or loss. Thus, necessary entry and access points should be implemented to guarantee only authorised personnel can access secure areas.

Controls should be implemented to ensure reasonable assurance that only authorised persons have physical access, and that they are accurately identified.

The use of locks, keys (manual and electronic), security guards, monitoring systems, and other barriers at entrances and access points should be implemented. Access control systems such as passwords, card keys, or biometric devices should be used to secure sensitive areas within the facility.

What Is Involved and How to Meet the Requirements

Organisations must control and, if possible, separate access points such as delivery and loading zones and other points of entry to the premises from their IT facilities to prevent unauthorised access, in order to meet the demands of Annex A 7.2 implementation. These areas should be limited to authorised personnel only.

The ISO 27001:2022 document provides implementation guidance for Annex A 7.2, which assists in meeting the requirements for personnel, visitors and delivery people. To view these guidelines, access the revised version of the standard.

Changes and Differences from ISO 27001:2013

Annex A 7.2 in ISO 27001:2022 is not a new measure, but rather a combination of Annex A Controls 11.1.2 and 11.1.6 from ISO 27001:2013. These two Annex A Controls have been revised in ISO 27001:2022 to make it more intuitive than ISO 27001:2013.

Annex A Control 11.1.2 – Physical Entry Controls requires secure areas to be safeguarded by proper entry controls, so that only authorised personnel can gain access. This part of the standard outlines the measures organisations can take to ensure that only those permitted may enter for specific purposes.

The regulation requires that two-factor authentication be implemented for authorised personnel to gain access to information security sensitive areas, with a physical log book or electronic audit trail to support it.

Annex A Control 11.1.6 – Delivery and Loading Areas stipulates that access to these areas should be restricted to authorised personnel only. It is advised that they be designed so that they are separated from operational areas, thereby preventing delivery personnel from accessing other parts of the building.

Ultimately, Annex A Control 7.2 and Annex A Controls 11.1.2 and 11.1.6 are comparable in essence. The major distinction is that Annex A 11.1.2 and Annex A 11.1.6 were amalgamated for enhanced user-friendliness.

In the 2022 version of ISO 27001, an attributes table and control purpose were included, which were absent from the controls of the 2013 version.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

Who Is in Charge of This Process?

Controlling physical access is paramount for the security of any organisation or business. Ensuring no unauthorised personnel enter the premises is essential. Consequently, the implementation of stringent measures is essential.

The security department oversees all physical security aspects, such as entry control. Should they lack the necessary expertise or resources to manage this, they may assign authority to another department.

IT teams are crucial for physical security as well. They guarantee that the technology systems used for physical security are current and secure. For instance, if your organisation has an Intrusion Detection System (IDS) at the entrance but the software hasn’t been renewed in months, it may not be effective against intruders.

What Do These Changes Mean for You?

Your organisation need not alter their information security practices significantly, as the ISO 27001:2022 revised standard was only minimally adjusted.

If you possess an ISO 27001:2013 certification, you will discover that your current information security management approach is in compliance with the new standards.

If you are starting from the beginning, you should acquaint yourself with the compliance guidance in the new standard.

How ISMS.Online Help

Our platform gives users access to all relevant documentation and resources, such as policies, procedures, standards, guidelines and info on compliance processes.

ISMS.online is perfect for businesses seeking to:

• Manage ISO certification process more effectively.
• Ensure customer satisfaction with our proof of adherence to ISO 27001.
• Maximise output by employing one system for all audits and checks.
• Ensure uniform excellence management across the business to raise customer gratification.

Our platform offers customised dashboards that grant you real-time insight into your compliance status.

Monitor and manage your ISO 27001:2022 compliance journey all in one spot: audits, gap analysis, training management, risk assessment, and more.

Contact us now to schedule a demonstration.