ISO 27001 Control 7.6: Working in Secure Areas

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.6, working in secure areas, requires security measures for people working in secure areas. Many small businesses have no secure area and can justify excluding it; where one exists, a few short rules on access, supervision and recording devices are usually enough.

Control 7.6 is about the rules for working inside secure areas: server rooms, comms rooms, secure storage, anywhere you have decided needs more protection than the rest of the office.

For most of the small businesses I work with, there are no such areas. Their servers are in the cloud, their network kit sits in a locked cabinet, and nobody “works” in the cabinet. In those cases 7.6 is often excluded, and auditors accept that with a sensible justification. But where a secure area does exist, even a small one, the rules for using it matter.

This page covers when 7.6 applies, what the rules should cover, and how to justify excluding it.

What control 7.6 actually asks for

The control requires security measures for working in secure areas to be designed and implemented. In practice, where you have secure areas:

• Only people who need to be there. And only when they need to be.
• Supervision of others. Contractors, engineers and visitors escorted or supervised.
• No recording without permission. Photography and recording devices controlled.
• Locked when empty. And checked periodically.
• Awareness. People who use the area know the rules.

In the 2013 edition this was control A.11.1.5.

Do you have any secure areas?

Start with the honest question. A secure area is somewhere you have chosen to protect more strongly because of what is in it. For a small business that might be a comms room, a cupboard with a server rack, or a room where confidential client material is handled.

If you have none, say so in the Statement of Applicability: for example, “No secure areas on our premises. All information processing is hosted with our cloud providers, whose data centre controls are inherited and evidenced by their SOC 2 reports.” That is a complete justification.

When you do

Where a secure area exists, keep the rules short and practical:

• Name the people who may enter unaccompanied, and keep the list short.
• Escort or supervise anyone else, including the IT support engineer.
• No photographs of the area or its equipment without permission.
• Keep it locked when empty, and do not let it become a store room.
• Record visits by third parties, especially maintenance under control 7.13.

Data centre operators apply rules like these at scale. For cloud-hosted systems, the NCSC’s cloud security principles describe what you should expect your provider to do in theirs.

What auditors will look for

If you have a secure area, I ask to see it and the rules for using it.

1. Whether secure areas exist, and the Statement of Applicability decision that follows.
2. The rules, where they do.
3. Who can enter, compared with who actually does.
4. Third-party visits, and whether they were supervised.

Common issues

• Secure areas used as general storage.
• Engineers left alone in comms rooms.
• No list of who may enter.
• 7.6 excluded with no reasoning, or included with rules nobody follows.

The self-check

If you have no secure area, the first question may be the only one.

• Do you have anywhere you treat as a secure area?
• Who can go in unaccompanied?
• When an engineer last visited, were they supervised?
• Is the area also used for storage?
• Does your Statement of Applicability reflect the answer?

What I see in audits

In practice, very few of my clients have a secure area of their own. Most of what used to sit in a locked room now runs in the cloud or in a data centre, where the provider’s secure areas are an inherited control. For those clients, 7.6 can usually be excluded with a short, specific justification, or marked as inherited with the provider’s assurance report as evidence.

Where a client does have a room that matters, perhaps a small comms room or a records store, a few short rules are enough: who may go in, whether visitors must be accompanied, and whether phones and cameras are allowed. The trap is excluding the control by habit when a room like that exists.

How control 7.6 links to other clauses and controls

• Control 7.3, Securing offices, rooms and facilities. Securing the area itself.
• Control 7.2, Physical entry. Getting into it.
• Control 7.13, Equipment maintenance. Engineers working inside it.
• Control 5.23, Information security for use of cloud services. Where cloud data centre rules are relied on.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• National Protective Security Authority. UK government guidance on physical and protective security.
• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Cloud security principles: asset protection and resilience. NCSC guidance on data centre security you should expect from a cloud provider.
• Unauthorised entry. NPSA guidance on secure rooms and access control.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call