ISO 27001 Control 7.2: Physical Entry

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.2, physical entry, requires secure areas to be protected by appropriate entry controls. For a small business that means knowing who can get into your office or space, managing keys and fobs when people join and leave, and handling visitors sensibly.

When I visit a client’s office as an auditor, I am not there to test their locks. I am there to see whether the documents match the experience. If the access control policy says visitors sign in and are escorted, was I asked to sign in? Was I escorted? Did someone issue me a pass, and take it back when I left? That ten minutes at the front door tells me more about control 7.2 than anything in the policy.

Control 7.2 is about how people get into the areas that matter. For most small businesses that is less about high-security doors and more about doing consistently what you say you do. For remote and co-working businesses, much of it is inherited.

This page covers what the control requires, how it applies at different sizes of business, and what an auditor actually looks for.

What control 7.2 actually asks for

The control requires secure areas to be protected by appropriate entry controls and access points. In practice:

• Only authorised people get in. Through keys, fobs, codes, reception or a combination.
• Access is managed. Issued when needed, removed when not, reviewed periodically.
• Visitors are handled. Signed in, identified, escorted where appropriate, and signed out.
• Deliveries do not become a way in. Delivery and loading areas are controlled, so a courier cannot wander into the office.
• It matches your policy. Whatever you have written down is what actually happens.

In the 2013 edition this was split between A.11.1.2, physical entry controls, and A.11.1.6, delivery and loading areas. The 2022 version combines them.

Documents versus experience

Here is what I am looking for when I arrive, and what you can check yourself the next time someone visits:

• Was the visitor asked to sign in, and was the visitor log actually filled in for previous visits?
• Were they escorted, or left to find their own way?
• If passes are issued, was one issued, and was it collected on the way out?
• Do fobs or keys match the current staff list? Ask for the list of issued fobs and compare it with HR.
• Is anything propped open that the policy says should be closed?

None of this needs expensive systems. A small business can meet 7.2 with a reception desk or a doorbell, a paper visitor book and a list of who holds keys. What it cannot do is write a policy describing badge-controlled turnstiles and then let visitors walk in unannounced.

Leavers and fobs

Leavers are the usual weak point in system access, but physical entry is often the exception. Where my clients have an office, the list of issued fobs is almost always up to date, as I describe below. The gaps I do find are the things nobody owns: a door code that has not changed in five years, or keys nobody ever counted. Put physical access on the same leavers checklist as system access under control 6.5, and review the list of issued fobs and keys periodically.

Remote, co-working and shared buildings

If you have no office, entry control to your information is mostly a matter for your cloud provider, whose data centre access controls are described in its assurance reports. If you work from a co-working space or a shared building, the landlord typically runs reception, fobs and visitor management. Record that as an inherited control, keep their terms or security statement, and make sure you tell them when one of your people leaves so their access is removed.

What stays with you is anything inside: a locked room, a comms cupboard, a cabinet. Those need their own entry control, even if it is just a key held by two named people.

What auditors will look for

At the door, I am less interested in the policy than in what happens when I arrive.

1. The policy. What does it say about access, visitors and deliveries?
2. My own arrival. Did the experience match the policy?
3. The access list. Who holds fobs or keys, compared with the current staff list.
4. Leavers. Pick a recent leaver: when was their physical access removed?
5. Inherited controls. If the landlord manages entry, what do you know about how they do it?

Common issues

• A policy describing controls that do not exist in practice.
• Visitor books that nobody fills in.
• Door codes unchanged for years and known to former staff.
• Couriers and contractors able to walk straight into the office.
• No record of what the landlord or co-working provider does.

The self-check

Walk to your own front door and look at it as a stranger would.

• Was the last visitor to your office signed in and escorted?
• Who holds a fob or key today, and does that match your staff list?
• When was the door code last changed?
• What happens when a courier arrives?
• If your landlord controls the door, what do they do when one of your people leaves?

Swipe cards are not the whole answer

The laptop theft I describe under control 7.1 happened in an office with swipe card entry. The cards controlled the door; they did nothing about who walked in behind someone else, and there was no record or camera to check afterwards. Entry control is a chain: the card system, the habit of not holding the door for strangers, and some way of knowing after the event who was there. Most small offices have the first and assume it covers the other two.

When I audit 7.2, I am less interested in the access control policy than in what happens at the door. I ask who issued the fobs, when the list was last checked against current staff, and what a visitor actually experiences on arrival. The documents are usually fine. The experience often is not.

One thing is reassuring. On the relatively rare occasions I visit a client’s site, the list of who holds keys and fobs is almost always up to date. In my experience every client with an office had one that matched current staff. It is usually managed by the landlord, a shared-services team or a facilities function, and people stay on top of it, probably out of necessity rather than any particular security maturity. Lost fobs cost money and locked-out staff complain, so the list gets maintained. The weaknesses I find are in the behaviour around the door, not the list behind it.

How control 7.2 links to other clauses and controls

• Control 7.1, Physical security perimeters. The boundary entry controls protect.
• Control 7.3, Securing offices, rooms and facilities. What visitors can reach once inside.
• Control 5.15, Access control. The access control policy covers physical access too.
• Control 5.18, Access rights. Issuing and removing access, physical and logical.
• Control 6.5, Responsibilities after termination or change of employment. Leavers return keys and fobs.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• National Protective Security Authority. UK government guidance on physical and protective security.
• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Unauthorised entry. NPSA guidance on doors, locks, access control and visitor management.
• A guide to data security. ICO guidance, including physical security and supervising visitors.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call