ISO 27001 Annex A 7.2 Physical access controls for secure areas

This control is broader than ISM-0225.

ISM-0225 requires that unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas to reduce eavesdropping/exfiltration risk. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate physical entry controls for secure areas, which can include screening people and items entering (e.g., device checks) and thus can be used to enforce the ISM-0225 prohibition. Annex A 7.2 is broader because it covers all secure-area entry control measures, not specifically RF/IR device prevention in high-classification zones.

This control is broader than ISM-0810.

ISM-0810 requires classified systems to be hosted in facilities that meet the requirements for a security zone appropriate to their classification. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate entry controls and access points to protect secure areas, which is a core feature of establishing and enforcing facility zoning. Annex A 7.2 is one type of physical control used within a zone model, while ISM-0810 is the overarching requirement to ensure the entire facility meets the relevant zone standard for classified systems.

This control is broader than ISM-2070.

ISM-2070 requires organisations to prevent unauthorised photographic and video recording devices from being brought into SECRET and TOP SECRET areas. This relates to ISO/IEC 27001:2022 Annex A 7.2, which requires appropriate entry controls to protect secure areas, and those entry controls can include screening for prohibited devices at access points. Annex A 7.2 is broader because it covers all physical entry/access control measures, whereas ISM-2070 is a specific prohibition focused on recording devices in high-classification areas.

This control partially meets ISM-0164.

ISM-0164 requires preventing unauthorised viewing of workstation displays and keyboards inside facilities. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate physical entry controls for secure areas, which reduces the likelihood that unauthorised people can get close enough to observe screens. A 7.2 is broader (who can enter), while ISM-0164 is about what can be observed even within or near those areas.

This control partially overlaps ISM-0306.

Annex A 7.2 requires secure areas to be protected by entry controls so only authorised people can enter. ISM-0306 relates by requiring uncleared technicians to be escorted during maintenance, which is a procedural control to manage access into and within secure areas when entry must be granted. ISM-0306 is narrower and scenario-specific (maintenance by non-cleared personnel) and focuses on supervision rather than the design of entry controls at access points.

This control partially overlaps ISM-0813.

Annex A 7.2 requires secure areas to be protected by appropriate entry controls and managed access points so only authorised people can enter. ISM-0813 relates by requiring server rooms, communications rooms, and security containers to not be left unsecured, which is a practical control to prevent opportunistic unauthorised entry. ISM-0813 is narrower and operational (secure-state/locking discipline) and does not by itself establish the full entry control regime (e.g. authorisation, visitor handling, access point design) expected under Annex A 7.2.

This control partially overlaps ISM-1053.

Annex A 7.2 requires protecting secure areas through appropriate entry controls and access points. ISM-1053 overlaps by requiring classified servers, network devices, and cryptographic equipment to be secured in server/communications rooms that meet security zone requirements suitable for their classification, which necessarily involves controlled physical access. ISM-1053 is broader in facility/security-zone specification for classified equipment, while Annex A 7.2 is specifically about entry controls and access point protection regardless of classification scheme.

This control partially overlaps ISM-1074.

Annex A 7.2 requires organisations to protect secure areas through controlled entry and access points. ISM-1074 directly relates by mandating that keys or equivalent access mechanisms to server rooms, communications rooms, and security containers are appropriately controlled, which is a core method of enforcing authorised entry. ISM-1074 focuses on controlling the credential/mechanism (keys, badges, etc.) rather than the broader secure-area entry control design and processes covered by Annex A 7.2.

This control partially overlaps ISM-1296.

ISM-1296 requires physical security to prevent unauthorised access to network devices in public areas and to reduce the likelihood of tampering or theft. ISO/IEC 27001:2022 Annex A 7.2 requires appropriate entry controls for secure areas, which can be used to restrict access to communications rooms, cabinets, or other spaces housing network devices. They overlap where access controls (locks, badges, controlled doors) are the method used to protect publicly adjacent network equipment, but ISM-1296 can also be met through device-level protections even when an area cannot be made a 'secure area'.

This control partially overlaps ISM-1327.

ISM-1327 requires certificates used for network authentication to be protected using logical and physical access controls, encryption, and user authentication. ISO/IEC 27001:2022 Annex A 7.2 focuses on entry controls for secure areas, which helps protect physical locations where certificate authorities, HSMs, or servers holding certificate private keys are hosted. ISM-1327 also requires logical controls, encryption, and authentication that Annex A 7.2 does not address, so the overlap is limited to physical protection of environments holding certificate material.

This control partially overlaps ISM-1973.

Annex A 7.2 requires secure areas to be protected by appropriate entry controls and controlled access points. ISM-1973 supports this by requiring non-classified systems to be secured in suitably secure facilities, which typically includes implementing physical access restrictions aligned to Annex A 7.2. ISM-1973 is broader and higher-level about facility suitability, whereas Annex A 7.2 focuses on the specific requirement for entry controls and access point protection.

This control supports ISM-1974.

ISM-1974 requires non-classified servers, network devices, and cryptographic equipment to be secured in suitably secure server rooms or communications rooms. ISO/IEC 27001:2022 Annex A 7.2 requires entry controls for secure areas, which are a prerequisite for a room to be meaningfully 'secure' against unauthorised physical access. Without Annex A 7.2-style access controls, implementing ISM-1974's secure-room requirement would be incomplete or ineffective.

This control supports ISM-2007.

ISM-2007 requires organisations to control medical devices in SECRET and TOP SECRET areas by maintaining and verifying an authorised device register. This supports Annex A 7.2 because effective entry controls for secure areas commonly include controlling what devices can be brought through access points, not just who can enter. Annex A 7.2 focuses on physical entry controls, while ISM-2007 focuses on device authorisation/traceability once access is sought or granted.