ISO 27001:2022 Annex A Control 7.3

What Is the Purpose of ISO 27001:2022 Annex A 7.3?

The goal of ISO 27001:2022 Annex A Control 7.3 is to protect the organisation’s information and other associated assets in offices, rooms, and facilities from unauthorised physical access, damage, and interference.

The primary objective of ISO 27001:2022 Annex A 7.3 is to reduce the risk of unauthorised physical access to offices, rooms, and facilities to an acceptable level by:

• Preventing unauthorised individuals from entering offices, rooms, and facilities is essential. All personnel must be authorised before they can gain access.
• Prevent harm or disruption to the organisation’s data and other related assets within workplace areas, rooms and facilities.
• Ensure information security sensitive areas are discreet so that it is difficult to discern their purpose.
• Minimising the chance of theft or property loss in offices, rooms, and facilities.
• Ensure identification of personnel authorised for physical access via a combination of uniforms, electronic door entry systems, and visitor passes.
• Where feasible, CCTV or other surveillance systems should be implemented to ensure security in vital areas such as doors/exits.

Annex A 7.3 pertains to all structures utilised by the organisation for offices or administrative operations. It also covers rooms in which confidential data is retained or processed, including areas where sensitive conversations occur.

This does not include reception areas or other public parts of an organisation’s premises, unless they are utilised for administrative purposes, such as when a reception area serves as an office.

What Is Involved and How to Meet the Requirements

Annex A 7.3 of ISO 27001:2022 stipulates that rooms and facilities must be safeguarded. To fulfil these requirements, the following security measures should be taken:

• Locating critical facilities to prevent public access.
• Ensure buildings are not intrusive and demonstrate minimal indication as to their purpose, with no clear signs either inside or outside the building that show information processing activities are taking place.
• Set up systems to protect confidential data and activities from being heard or seen from the outside. Electromagnetic shielding may be necessary.
• Make sure directories, internal phone books and online maps showing the whereabouts of confidential info processing facilities accessible to any unauthorised person.

For further details on reaching the control stipulated in the ISO 27001:2022 standard, consult the document.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 7.3 replaces ISO 27001:2013 Annex A 11.1.3 in the revised 2022 standard.

Annex A 7.3 is not a novel control. It is a modified version of Annex A 11.1.3 in ISO 27001:2013. The most significant distinction between the 2013 and 2022 versions is the Annex A Control Number has been altered. Apart from this adjustment, the context and general meaning remain unchanged, despite the rephrasing.

The 2022 Annex A Control features an attributes table and statement of purpose, which are absent from the 2013 version.

Who Is in Charge of This Process?

The first person to consult when arranging offices, rooms, and facilities is usually the manager or director in charge of the building and its contents.

The security manager oversees security in all areas, including offices and facilities. He/She keeps tabs on all personnel with access to these areas and ensures their use is appropriate.

In certain instances, multiple people may be responsible for security. For example, where an individual has access to sensitive information that could be detrimental to the business or to other staff members’ private lives, it is essential to have several individuals involved in their security.

The HR department are responsible for employee insurance policies and benefits, while IT manage computer systems and networks. Both departments are involved in managing physical safety, as well as cyber security issues such as phishing scams and unauthorised access attempts.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

What Do These Changes Mean for You?

No significant modifications are necessary to conform to the most up-to-date version of ISO 27001:2022.

Evaluate your existing information security solution to make sure it meets the renewed standard. If you’ve modified anything since 2013 when the last edition was issued, consider reviewing those changes to decide if they’re still applicable or need to be revised.

How ISMS.Online Help

Our platform is perfect for beginners in information security or those who want to quickly gain an understanding of ISO 27001:2022 without needing to invest time in studying from the beginning or reviewing long documents.

ISMS.online is kitted out with all the tools needed to meet compliance, including personalised document templates, checklists and policies.

Contact us now to schedule a demonstration.