ISO 27001 Annex A 7.1 Physical security perimeters
What it says
Security perimeters shall be defined and used to protect areas that contain information and other associated assets.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDefine clear physical boundaries to protect sensitive areas and assets from unauthorised access.
This control is about setting up clear physical boundaries to keep unauthorised people from accessing important areas and assets, like confidential files or important equipment. If you don't do this, someone could easily sneak into your business and steal or damage valuable information, which could seriously harm your operations and reputation.
Free. Save your status, tasks and notes.
Why it matters
Poorly defined physical perimeters leave critical areas like server rooms vulnerable to unauthorised access, leading to potential data breaches or equipment theft.
How to implement
The facility manager should identify and map out areas in your building that contain sensitive information or equipment.
Use physical barriers like walls and fences to clearly mark these areas, ensuring they're sound and without gaps.
The security team needs to ensure all entry points, such as doors and windows, are secured with appropriate locks and alarms.
Test these locks regularly and monitor them with cameras linking back to a security office.
IT staff should coordinate with security to install and maintain alarm systems on fire doors.
These alarms should be checked regularly to make sure they work properly and operate in a fail-safe manner.
Management should establish procedures to lock windows and doors when the area is unattended.
Regular training should be provided to employees about these procedures to ensure compliance.
Facilities management needs to conduct regular security assessments based on ASD Essential Eight to strengthen security barriers against heightened threats, aligning with Australian Privacy Act 1988 to protect personal data.
Keep it running
Document physical perimeters for secure areas (walls/doors/fencing), minimise entry points, use clear signage, and periodically verify barriers, locks and access controls match the defined boundary.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the facility's security perimeter plan or maps.
Look at
Ensure the map clearly highlights secure areas with appropriate boundaries.
Good evidence
A detailed layout showing all sensitive areas marked with solid barriers and access control systems.
- Check 2 of 5What an auditor asks for
Ask for
Request maintenance logs of security systems and alarms.
Look at
Check records for regular testing and maintenance schedules.
Good evidence
Comprehensive logs showing consistent maintenance checks and prompt resolutions.
- Check 3 of 5What an auditor asks for
Ask for
Request a demonstration of the physical access control systems (e.g., alarm and camera systems).
Look at
Verify alarms trigger properly and cameras cover all entry points.
Good evidence
Fully operational systems that provide immediate alerts and comprehensive surveillance.
- Check 4 of 5What an auditor asks for
Ask for
Request records of security training sessions.
Look at
Check for regular sessions with all relevant staff attending.
Good evidence
Detailed records showing frequent and well-documented training on security procedures.
- Check 5 of 5What an auditor asks for
Ask for
Request access control logs or audits.
Look at
Ensure the logs reflect authorised access only, with any exceptions or incidents documented.
Good evidence
Complete access logs showing adherence to policies, with any incidents promptly addressed.
Mappings
Closest match in ASD Information Security Manual: ISM-0225, Prevent unauthorised RF and IR device entry, which this control covers in full and more.
ASD Information Security Manual: 12 mappings
This control is broader than ISM-0225.
Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets. ISM-0225 relates by restricting what devices may cross the defined perimeter into SECRET and TOP SECRET areas, reducing the risk of compromise once inside the boundary. The ISO control is broader because it covers establishing and enforcing the perimeter itself, while ISM-0225 is a specific rule applied within high-security zones.
This control is broader than ISM-0810.
ISM-0810 requires that facilities hosting classified systems meet the requirements of an appropriate security zone for the classification. ISO/IEC 27001:2022 Annex A 7.1 requires defining and using physical security perimeters to protect areas containing information assets, which is a foundational method used to construct security zones. Annex A 7.1 is a general perimeter control and does not by itself ensure zone compliance for classified systems, whereas ISM-0810 is explicitly tied to classification-appropriate facility zoning.
This control is broader than ISM-0829.
Annex A 7.1 requires defined physical security perimeters to protect sensitive areas and assets from unauthorised access. ISM-0829 relates by mandating measures to detect and respond to unauthorised RF devices within SECRET and TOP SECRET areas, which is an enforcement mechanism supporting perimeter integrity for those zones. The ISO control is broader, as it covers all perimeter types and access threats, whereas ISM-0829 is limited to RF device detection/response in specific classified areas.
This control is broader than ISM-1053.
ISM-1053 requires classified ICT and cryptographic equipment to be located in secure server/communications rooms that satisfy security zone requirements suitable to their classification. Annex A 7.1 requires defined physical security perimeters to protect areas containing information and associated assets, which would include establishing perimeters around secure rooms hosting classified equipment. ISM-1053 is a specific application of perimeter concepts to classified equipment locations, whereas Annex A 7.1 applies to any protected area.
- ISM-1098Segregate SECRET cable terminations using individual cabinets or division platesBroader than
This control is broader than ISM-1098.
ISM-1098 requires SECRET cabling to be terminated at cabinet boundaries (or separated by a division plate in small systems), limiting where classified cable runs can extend and where exposure can occur. This relates to Annex A 7.1 because defining and enforcing physical security perimeters commonly includes controlling how services (including cabling) traverse and terminate at the boundary of secure areas and equipment enclosures. ISM-1098 is a very specific, classified-cabling implementation detail, while Annex A 7.1 is broader and applies to physical perimeter controls for many asset types, not just cables or cabinets.
This control is broader than ISM-1974.
ISM-1974 requires non-classified servers, network devices, and cryptographic equipment to be secured in suitably secure server rooms or communications rooms to prevent unauthorised physical access. ISO/IEC 27001:2022 Annex A 7.1 requires defined physical security perimeters to protect areas containing information assets, which is the broader mechanism that would encompass securing server/communications rooms. ISM-1974 is a specific application of perimeter-based protection focused on particular types of IT equipment and room types.
This control partially meets ISM-1074.
ISM-1074 requires keys or equivalent access mechanisms to server rooms, communications rooms and security containers to be appropriately controlled. ISO/IEC 27001:2022 Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets, which commonly includes server/communications rooms. Annex A 7.1 is broader because it covers perimeter definition and physical boundary protections, whereas ISM-1074 focuses specifically on controlling the mechanisms (keys/equivalents) used to cross those boundaries.
This control partially overlaps ISM-1137.
ISM-1137 necessitates contacting ASD for an emanation security threat assessment for high-security systems. Annex A 7.1 requires defining physical security perimeters for areas with information assets, where emanation risk assessments may inform such perimeters. Therefore, ISM-1137's focus on assessment influences Annex A 7.1's perimeter definition.
This control partially overlaps ISM-1296.
ISM-1296 requires physical security measures to protect network devices located in public areas from physical damage or unauthorised access. ISO/IEC 27001:2022 Annex A 7.1 requires defining and using physical security perimeters to protect areas containing information and associated assets, which can include perimeters around comms cupboards, kiosks, or public-facing device locations. They overlap where perimeters are used to reduce unauthorised physical access to network equipment, but Annex A 7.1 focuses on area boundary design while ISM-1296 is specifically about safeguarding the devices themselves in public areas (e.g., enclosures, mounting, locking).
This control supports ISM-0813.
Annex A 7.1 requires security perimeters to be defined and used to protect areas containing information and associated assets. ISM-0813 supports this by requiring server rooms, communications rooms and security containers not be left unsecured, which maintains the effectiveness of those areas' physical boundaries over time. Annex A 7.1 focuses on defining and applying perimeters, while ISM-0813 focuses on operational discipline to prevent perimeter breakdown through unsecured states.
This control supports ISM-1975.
Annex A 7.1 requires organisations to define and use physical security perimeters to protect areas containing information and associated assets. ISM-1975 supports this by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure containers, effectively creating a localised perimeter around critical assets. Annex A 7.1 is primarily about boundary controls for areas, while ISM-1975 is about containerisation of equipment even where the surrounding area perimeter may be weaker.
This control supports ISM-2070.
Annex A 7.1 requires organisations to define and use physical security perimeters to protect areas containing information and associated assets. ISM-2070 strengthens those perimeters by reducing the likelihood of covert capture of information within designated SECRET and TOP SECRET areas by prohibiting unauthorised recording devices. While Annex A 7.1 focuses on establishing and enforcing physical boundaries and controlled entry, ISM-2070 is a specific in-area rule addressing information leakage once inside the perimeter.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.