ISO 27001 A.7.1 - Physical Security Perimeters

Requirement

“Security perimeters shall be defined and used to protect areas that contain information and other associated assets.”

Plain-language meaning

The organization should know which physical areas need protection and where the boundaries are. A perimeter can be a building boundary, floor, room, cage, cabinet, loading area, reception barrier, secure office, server room, records archive, or customer-specific zone.

The perimeter must be real enough to control entry and, where needed, record entry and exit. A wall that stops at a suspended ceiling, a shared landlord master key, or an unmonitored internal door can break the assumed perimeter.

Why this matters

Information security is not only digital. People can steal equipment, view screens, access paper records, tamper with network gear, enter shared offices, or exploit weak reception and fire-door controls.

Physical control should be layered. Do not rely only on the outside door. Larger or higher-risk premises need internal zones so compromise of one area does not automatically expose everything else.

Implementation guidance

1. Identify areas containing information and associated assets

Examples include:

• offices handling confidential information;
• server rooms and network rooms;
• records archives;
• reception areas;
• delivery and loading areas;
• print rooms;
• plant rooms supporting power, cooling, or network services;
• customer-dedicated areas;
• shared premises or multi-tenant floors.

2. Define zones and perimeters

Each protected zone should have a clear boundary and purpose.

A zone model can be a diagram, floorplan, table, or site security model. It should show boundaries and controlled connections between zones.

3. Use risk assessment to select controls

Controls should reflect the risk of the area.

Examples:

• reception desk or staffed entry;
• walls, doors, locks, barriers, cages, or cabinets;
• badge or access card controls;
• visitor escort requirements;
• CCTV or monitoring where appropriate;
• fire-door controls that preserve safety and security;
• alarms or intrusion detection;
• after-hours access controls;
• lone-working authorization or monitoring;
• landlord/shared-building access controls and risk acceptance where relevant.

4. Check perimeter completeness

Do not assume a perimeter works because it appears on a plan. Check how it can be bypassed.

Examples:

• internal wall stops at suspended ceiling;
• shared building management has master keys;
• fire doors are propped open;
• reception is unattended;
• loading bay connects directly to secure areas;
• visitors can tailgate through staff doors;
• out-of-hours cleaners or maintenance staff can access secure areas.

5. Define management procedures

Physical security procedures should define:

• zone owners;
• access authorization;
• perimeter inspection;
• key/card management;
• out-of-hours and lone-working rules;
• emergency evacuation handling;
• visitor and contractor access;
• exception handling;
• review frequency.

Audit guidance

Auditors should verify that physical security perimeters are defined, used, and appropriate for the information and assets they protect.

Audit testing should include:

• zone/perimeter diagrams or registers;
• physical security risk assessment;
• walkthrough of boundaries, doors, walls, reception, fire exits, and shared areas;
• review of normal and emergency entry/exit handling;
• out-of-hours and lone-working controls;
• landlord/building-management access arrangements;
• evidence of perimeter inspections and reviews;
• access records for sensitive zones where applicable;
• interviews with facilities, security, reception, IT, and business owners.

The auditor should ask what each perimeter is intended to achieve, such as separating customer zones, protecting classified information, restricting server-room access, or controlling visitor movement.

Evidence examples

Strong evidence

• Zones are defined based on assets, information classification, business process, and risk.
• Perimeters are documented and physically complete enough for their purpose.
• Entry and exit routes are controlled for sensitive zones.
• Emergency exits preserve life safety while still being managed.
• Out-of-hours and lone-working access is authorized and monitored where needed.
• Shared-building and landlord access are risk-assessed.
• Perimeters are reviewed after layout, tenancy, process, or asset changes.

Weak evidence

• Building floorplan exists but no security zone model.
• Perimeter does not reach above a suspended ceiling.
• Fire doors are routinely propped open.
• Shared landlord master key exists with no risk assessment.
• Reception is unattended with no compensating control.
• Sensitive assets sit in general office space without risk acceptance.
• No review after office layout or business process changes.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.2 Physical Entry
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.12 Classification of Information
• A.5.15 Access Control
• A.5.18 Access Rights
• A.6.7 Remote Working
• Risk Assessment
• Statement of Applicability
• Physical Security Zone Register
• Physical Security Perimeter Review Checklist
• A.7.1 Audit Evidence Pack
• A.7.1 Audit Checklist

KB-ready summary

• A.7.1 requires defined and used security perimeters for areas containing information and associated assets.
• Physical zones should be based on risk, information sensitivity, assets, business process, and occupancy.
• Perimeters can be external or internal.
• Multiple zones may be needed for larger or higher-risk premises.
• Auditors should inspect actual bypass paths, not only diagrams.
• Shared premises, emergency exits, out-of-hours access, and incomplete walls are common weak points.

Templates and checklists

• Physical Security Zone Register
• Physical Security Perimeter Review Checklist
• A.7.1 Audit Checklist