ISO 27001 A.7.3 - Securing Offices, Rooms and Facilities

Requirement

“Physical security for offices, rooms and facilities shall be designed and implemented.”

Plain-language meaning

The organization should design and implement physical protections for offices, rooms, and facilities based on what those areas contain and how critical or sensitive the work is.

Protection should match the value, liability, and importance of information and associated assets in the area. A general meeting room, a finance records room, a call center handling customer data, and a server room do not need the same controls.

Why this matters

Physical areas can expose confidentiality, integrity, and availability. People can view documents, overhear calls, find internal directories, identify target rooms from signage, tamper with equipment, or concentrate too much critical information in one place.

Centralized repositories and critical rooms create higher impact. If one room contains core records, backups, privileged equipment, network connections, or sensitive files, the physical protection around that room needs to be stronger.

Implementation guidance

1. Identify offices, rooms, and facilities requiring controls

Examples include:

• server rooms and network rooms;
• records archives;
• rooms processing classified or regulated information;
• finance, HR, legal, and customer service work areas;
• security operations areas;
• print/mail rooms;
• backup media storage;
• plant rooms supporting ICT services;
• rooms used by different customers or projects.

2. Match controls to value, liability, and importance

Use risk assessment to decide the control level.

The control should not be guessed from room labels. It should be tied to the information and assets present.

3. Avoid unnecessary clues about targets

Do not make sensitive rooms easy to identify.

Examples of weak practice:

• signs pointing to the server room;
• room names exposing purpose, such as “Payroll Records”;
• internal telephone directories accessible to visitors;
• printed internal contact lists at reception;
• door codes written on whiteboards or notice boards.

The goal is not secrecy theatre. It is avoiding unnecessary targeting information for unauthorized persons.

4. Control internal information exposure

Controls may include:

• clear desk and clear screen;
• secure storage for records and media;
• restricted room access;
• visitor escort and movement limits;
• secure disposal bins;
• privacy screens where needed;
• restrictions on notice boards and internal lists;
• rules for room booking and shared spaces.

5. Consider special controls only when justified

Some controls, such as electromagnetic shielding, can be relevant in specific contexts but can also disrupt normal operations, mobile connectivity, emergency communications, and business continuity.

Use risk assessment before applying specialized controls. Strong controls that break business operations are not automatically better.

Audit guidance

Auditors should verify that physical security requirements have been identified for offices, rooms, and facilities and that implemented controls are adequate for the risk.

Audit testing should include:

• room/facility security assessment;
• classification or asset mapping for rooms;
• secure-area procedures;
• physical walkthrough;
• review of room labels, signs, directories, notice boards, and phone lists;
• access restrictions for sensitive rooms;
• handling procedures for classified information;
• evidence that controls align with risk assessment;
• review of centralized information repositories and high-value rooms.

The auditor should try to identify sensitive room purposes from visible clues and check whether internal directories or access codes are exposed to unauthorized persons.

Evidence examples

Strong evidence

• Controls are based on value, liability, importance, and classification of information/assets.
• Sensitive rooms do not reveal their purpose unnecessarily.
• Internal directories, phone lists, and access codes are not exposed to outsiders.
• Physical controls match the most sensitive and critical information in the area.
• Centralized repositories have stronger protection.
• Specialized controls are risk-assessed before implementation.
• Room security is reviewed after layout, asset, process, or classification changes.

Weak evidence

• Server room or records room is clearly signposted.
• Internal phone lists are visible at reception or public areas.
• Door codes are written on notice boards or whiteboards.
• Room security is based on habit, not risk assessment.
• High-value records are stored in ordinary rooms with no added controls.
• Centralized repositories are not treated as higher impact.
• Specialized controls are implemented without business continuity consideration.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.1 Physical Security Perimeters
• A.7.2 Physical Entry
• A.7.4 Physical Security Monitoring
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.12 Classification of Information
• A.5.15 Access Control
• Risk Assessment
• Office Room and Facility Security Assessment
• Sensitive Room Signage and Directory Review
• A.7.3 Audit Evidence Pack
• A.7.3 Audit Checklist

KB-ready summary

• A.7.3 requires physical security for offices, rooms, and facilities to be designed and implemented.
• Controls should match the value, liability, importance, and classification of information/assets inside.
• Risk assessment should support design choices.
• Avoid visible clues that identify sensitive rooms, systems, directories, or access codes.
• Centralized repositories need stronger protection because impact is concentrated.
• Specialized controls should be used only where context justifies them.

Templates and checklists

• Office Room and Facility Security Assessment
• Sensitive Room Signage and Directory Review
• A.7.3 Audit Checklist