ISO 27001 Control 7.3: Securing Offices, Rooms and Facilities

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.3, securing offices, rooms and facilities, requires physical security for offices and rooms to be designed and applied. In a small business that means locking rooms that hold equipment or confidential material, keeping sensitive work out of sight of visitors, and not advertising what is where.

Once I am through the front door of a client’s office, the question changes. It is no longer who gets in, but what they can reach once they are inside. Is the network equipment in a locked cabinet? Is the comms room locked, or is the door held open with a fire extinguisher? That last one has happened. More than once.

Control 7.3 asks you to design physical security for offices, rooms and facilities. For a small business that usually comes down to a handful of practical things: lock away what matters, keep it out of public view, and make sure the arrangement is not quietly undone by convenience.

This page covers what the control requires, what to look at in your own office, and how it applies when you have no office at all.

What control 7.3 actually asks for

The control requires physical security for offices, rooms and facilities to be designed and implemented. In practice:

• Critical equipment in lockable spaces. Network equipment, any servers, and anything holding sensitive information.
• Not on display. Facilities that process sensitive information are not visible or accessible to the public.
• Not advertised. Signs and directories do not point visitors to where the valuable things are.
• Configured so the controls stay on. Doors close, locks lock, and nobody has to defeat them to get through the day.

In the 2013 edition this was control A.11.1.3. The intent is unchanged.

The fire extinguisher test

The commonest failure of 7.3 is not a missing lock. It is a lock that has been defeated because it was inconvenient. A comms room door wedged open because the room gets warm. A server cupboard that is also the stationery store, so everybody needs the key. A cabinet with the key left in it.

When you walk your office, look for those workarounds. Each one tells you either that the control is impractical and needs redesigning, such as better ventilation so the door can stay shut, or that people have not understood why it matters. Both are fixable. Neither is fixed by repeating the policy.

What to look at in a small office

• Network equipment. Router, switches and firewall in a locked cabinet or room, not on a shelf in the corridor.
• Any on-site servers. Usually legacy: a print server or domain controller. Locked away, with access limited to named people.
• Storage. Somewhere lockable for confidential papers and any equipment not in use.
• Meeting rooms. Screens and whiteboards that visitors can see from the corridor.
• Printers. Not next to the reception desk where visitors can pick things up.

If a cupboard or store room doubles as server space, that can be acceptable. Small businesses do it all the time. What matters is that the risk has been assessed and the space stays secure, which means it is locked and only the people who need to go in can.

No office at all

For a fully remote, cloud-only business, 7.3 is about the facilities you inherit: your cloud provider’s data centres, described in their published physical security documentation and assurance reports, and any co-working space you use. Home offices are covered by your remote working approach under control 6.7 rather than by 7.3. Record that reasoning in your Statement of Applicability.

What auditors will look for

I usually walk the office before I read anything about it.

1. A walk round. Where is the network equipment, and is it secured?
2. The comms room or cupboard. Locked? Who has the key? Is it also a store room?
3. Workarounds. Doors wedged, keys left in locks.
4. Visibility. Can visitors see screens, papers or equipment they should not?
5. For remote businesses, the Statement of Applicability justification and inherited evidence.

Common issues

• Comms room doors held open for ventilation or convenience.
• Server cupboards doubling as general store rooms, with keys held by everyone.
• Network equipment on open shelves in shared areas.
• Keys left in cabinet locks.
• Screens facing windows or corridors used by visitors.

The self-check

Try these during your next walk round the office.

• Where is your network equipment, and is it locked away?
• Who can open your comms cupboard, and why?
• Is any door that should be shut being held open?
• Could a visitor read a screen or pick up a printout on their way to a meeting?
• If you have no office, does your Statement of Applicability explain which facilities you rely on?

The door that was always open

At a software company where I once contracted, the server room door was propped open with a fire extinguisher, more or less permanently. You might say that did not matter, because the office itself was secured. But people came and went outside normal hours, and so did the cleaners, who were known to unplug key servers to plug in their vacuum cleaners. A locked door would have prevented both.

That is the real lesson of 7.3. The commonest failure is not a missing lock but a defeated one, and it is defeated for convenience: the room is warm, people go in and out, the door is heavy. If a room needs securing, make the secure state the easy one, or accept that it will not stay secure.

How control 7.3 links to other clauses and controls

• Control 7.1, Physical security perimeters. The outer boundary.
• Control 7.2, Physical entry. Who gets in.
• Control 7.6, Working in secure areas. Rules once inside a secure area.
• Control 7.8, Equipment siting and protection. Where equipment goes within the room.
• Control 6.7, Remote working. Covers home offices instead.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• National Protective Security Authority. UK government guidance on physical and protective security.
• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Unauthorised entry. NPSA guidance on secure rooms, locks and access control.
• Azure facilities and physical security. An example of how a cloud provider describes the facilities you inherit.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call