ISO 27001 Annex A 7.3 Physical security for offices and facilities
What it says
Physical security for offices, rooms and facilities shall be designed and implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure physical security to prevent unauthorised access to offices and facilities.
This control is about keeping your office and facilities secure so only the right people can get in. It's important because if unauthorised people get in, they could steal information, cause damage, or disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Without strong physical security, intruders can bypass digital defences, access sensitive equipment, and compromise or steal critical data.
How to implement
The premises manager should work with security experts to plan secure locations for important areas.
Make sure these areas are not easy for the public to access or see. Review entry points and ensure they are limited and well-protected.
IT staff need to configure security systems to prevent data leakage.
This might include ensuring walls and windows are soundproof and possibly setting up electromagnetic shielding. Regular checks should be done to verify these protective measures are in place and effective.
Facility managers should make the exterior of the building look non-descript.
Avoid signs that indicate sensitive operations inside. Ensure that no visual or audible indicators give away the nature of the work done inside the building.
HR should control the distribution of internal directories and location maps.
They should ensure only authorised personnel can access these, possibly by storing them on secure internal systems rather than sharing paper copies.
The security officer should install security systems like alarms and video surveillance in critical areas.
These systems need to be correctly set up, regularly tested, and monitored to ensure they work effectively if a breach is attempted.
Keep it running
Regularly test and update locks, alarms and badge access; review visitor logs to prevent unauthorised entry.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The building security plan or risk assessment.
Look at
How critical areas are protected from unauthorised access.
Good evidence
A documented plan with clearly defined access controls and designated secure zones.
- Check 2 of 5What an auditor asks for
Ask for
Records of maintenance and checks of security systems.
Look at
Whether these records show regular and thorough checks. GOOD is seeing a consistent record of maintenance, indicating systems are kept in good working order.
- Check 3 of 5What an auditor asks for
Ask for
To access directories or maps that identify secure locations.
Look at
The controls surrounding access to these documents. GOOD means access is restricted and logs are kept concerning who views these resources.
- Check 4 of 5What an auditor asks for
Ask for
About procedures for shielding against electromagnetic interference and information leaks.
Look at
The evidence of implementation, such as shielding assessments or plans. GOOD involves completed assessments and action plans addressing potential leaks.
- Check 5 of 5What an auditor asks for
Ask for
To see video surveillance policies and logs.
Look at
Whether the policies ensure sufficient coverage and whether logs show follow-through. GOOD means finding evidence that cameras are placed strategically and regularly monitored, with logs reviewed for suspicious activity.
Mappings
Closest match in ASD Information Security Manual: ISM-0164, Prevent unauthorised viewing of system displays, which this control covers in full and more.
ASD Information Security Manual: 11 mappings
This control is broader than ISM-0164.
ISM-0164 requires that unauthorised individuals cannot observe system displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented, which can include workstation placement, visitor management, and sightline controls that directly help meet ISM-0164. Annex A 7.3 is broader across facility physical security, while ISM-0164 is a specific protection objective focused on visual observation.
This control is broader than ISM-0198.
ISM-0198 requires that when an organisation intends to penetrate (i.e. physically breach/enter in a way that compromises the integrity of) a TOP SECRET audio secure room, it must consult ASIO and comply with any directions ASIO provides. This relates to Annex A 7.3 because Annex A 7.3 requires physical security for rooms and facilities to be designed and implemented, which includes establishing controlled procedures and authorisations for high-risk access or work that could compromise secure areas. ISM-0198 is narrower because it applies only to a very specific scenario (penetration of a TOP SECRET audio secure room) and prescribes a specific external-authority consultation and direction-compliance mechanism, whereas Annex A 7.3 is a general, organisation-wide physical security design/implementation requirement covering many room/facility types and controls.
This control is broader than ISM-0810.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented. ISM-0810 applies that concept specifically by requiring classified systems to be secured in facilities meeting the security zone requirements suitable for their classification. ISM-0810 is narrower because it is limited to classified systems and classification-driven facility requirements, while Annex A 7.3 applies across organisational facilities more generally.
This control is broader than ISM-0813.
Annex A 7.3 requires the design and implementation of physical security for offices, rooms and facilities to prevent unauthorised access. ISM-0813 supports that requirement by mandating that server rooms, communications rooms and security containers are not left unsecured, directly addressing operational discipline for securing critical physical areas. ISM-0813 is narrower because it focuses on specific rooms/containers and their secured state, whereas Annex A 7.3 covers the broader design and implementation of physical security across facilities.
This control is broader than ISM-1053.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented to control physical access. ISM-1053 mandates that classified servers, network devices and cryptographic equipment are secured in server/communications rooms meeting security zone requirements suitable for their classification. ISM-1053 is narrower because it is specific to classified ICT equipment and prescribed secure room requirements, whereas Annex A 7.3 covers physical security across all office and facility areas.
This control is broader than ISM-1107.
ISM-1107 mandates a facility visual-identification convention by prohibiting salmon pink or red colouring on certain wall outlet boxes to prevent misinterpretation of security classification within work areas. Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented, which includes establishing and enforcing consistent physical security cues and site standards that reduce human error and incorrect handling in secured environments. ISM-1107 is one concrete facility-standard rule within the broader physical security design and implementation activities covered by Annex A 7.3.
This control is broader than ISM-1164.
ISM-1164 mandates a specific physical design choice in shared facilities: using clear plastic covers/trays/fittings to ensure cable pathways are visible and harder to tamper with undetected. This fits within ISO/IEC 27001:2022 Annex A 7.3 because designing and implementing physical security for offices, rooms and facilities includes selecting building/fitting features that deter and reveal unauthorised physical modification in shared spaces. Annex A 7.3 is broader as it covers overall facility physical security design (e.g. secure rooms, barriers, access control and monitoring), while ISM-1164 is limited to visibility of cabling containment materials.
This control is broader than ISM-1296.
ISM-1296 requires physical security to protect network devices located in public areas from physical damage or unauthorised access. ISO/IEC 27001:2022 Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented, which includes controlling and securing areas where network devices may be placed. Annex A 7.3 is broader because it covers facilities generally, while ISM-1296 is a specific application focused on network devices in publicly accessible locations.
This control is broader than ISM-1973.
Annex A 7.3 requires physical security for offices, rooms and facilities to be designed and implemented to prevent unauthorised access. ISM-1973 specifically requires non-classified systems to be secured in suitably secure facilities, which is one concrete application of facility-level physical security. ISM-1973 is narrower because it is limited to non-classified systems and does not cover broader office/facility physical security design across all areas addressed by Annex A 7.3.
This control is broader than ISM-1974.
Annex A 7.3 requires an organisation-wide approach to designing and implementing physical security for offices, rooms and facilities. ISM-1974 addresses a subset of that by requiring non-classified servers, network devices and cryptographic equipment to be secured in suitably secure server or communications rooms. ISM-1974 is narrower because it focuses on ICT equipment placement/room security rather than the full spectrum of physical protections for all facilities covered by Annex A 7.3.
- ISM-1327Access controls, encryption and user authentication for X.509 certificatesPartially overlaps
This control partially overlaps ISM-1327.
ISM-1327 requires certificates used for network authentication to be protected using logical and physical access controls, encryption, and user authentication. ISO/IEC 27001:2022 Annex A 7.3 requires physical security for offices, rooms and facilities, which can reduce the risk of theft or tampering of systems that store certificate private keys. ISM-1327 extends beyond facility security by requiring logical access controls and cryptographic protections directly applied to certificate storage and use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.