A.7.3 Audit Checklist

When to use this

Use this checklist during an internal audit of physical security design for offices, rooms, and facilities.

Related controls

• A.7.3 Securing Offices Rooms and Facilities
• A.7.3 Audit Evidence Pack
• Office Room and Facility Security Assessment
• Sensitive Room Signage and Directory Review

Audit checklist

• Confirm room/facility security requirements are identified.
• Confirm controls are based on risk assessment.
• Check whether protection matches the most sensitive/critical information in each area.
• Walk the site and look for visible clues to sensitive rooms.
• Check internal phone lists, directories, notice boards, and access codes.
• Check centralized information repositories.
• Verify specialized controls are risk-justified and operationally workable.
• Check review records after layout, asset, or process changes.

Findings table