verifiedISO/IEC 27001:2022
ISO 27001 Annex A 7.6Security Measures for Working in Secure Areas
Official control statement
Security measures for working in secure areas shall be designed and implemented.
verifiedISO/IEC 27001:2022Annex A 7.6
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Implement security measures to control and protect activities in secure areas.
Physical controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about making sure that any rooms or areas in your business that need to be secure stay that way. It's important because if these areas aren't properly managed, sensitive information or valuable assets can be exposed to damage or theft, leading to financial loss or damage to your reputation.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Physical controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Poor control of secure areas can lead to unauthorised access, device misuse, and data breaches, harming reputation and finances.
settings
Operational notes
Audit secure-area work, supervise entry and visitors, restrict devices, and enforce clean-desk, screen-locking, and secure handling/disposal of sensitive media.
02 - Implement
build
Implementation tips
- The facilities manager should limit access to secure areas by issuing access cards or keys only to authorised personnel. They can do this by maintaining a log of who has access and reviewing this regularly to ensure only current employees who need access have it.
- The IT manager needs to ensure that any devices taken into secure areas are monitored and controlled. This can be done by setting up policies that require devices to be registered and checked for any unauthorised recording capabilities that might be used to breach security.
- Supervisors should ensure that no one is working alone in secure areas without oversight. This can be done by implementing a buddy system or scheduling multiple employees to work together in these areas, reducing both safety risks and the opportunity for misconduct.
- Security personnel should inspect vacant secure areas regularly to ensure everything is intact and nothing has been tampered with. This involves setting up a regular inspection schedule and maintaining a checklist of what to look for during these inspections.
- The HR department needs to make sure all employees are aware of emergency procedures and restrictions in secure areas. This can be achieved by holding regular training sessions and displaying procedures prominently within these areas in line with the ISO 27002:2022 guidance.
03 - Audit
fact_check
Audit / evidence tips
- AskRequest access logs for secure areas.Look atExamine the logs to see if they show who accessed the areas and when.GoodLogs should show that only authorised personnel have accessed the secure areas and that access is logged consistently.
- AskAsk to see the policy on carrying and using devices in secure areas.Look atCheck if the policy outlines clear restrictions and procedures for device registration and monitoring.GoodThe policy should have clear rules that are communicated to employees and provide guidance on how to comply with restrictions.
- AskRequest the training schedule and materials for personnel working in secure areas.Look atReview the schedule to ensure training is regular and materials cover emergency procedures and security protocols.GoodThere should be a well-documented training program with evidence of attendance by all relevant staff.
- AskAsk for records of inspections of vacant secure areas.Look atLook for a detailed inspection schedule and checklists that show inspections are conducted as planned.GoodRecords should confirm that regular inspections occur and note any issues found and resolved promptly.
- AskInquire about the buddy system or supervision logs for personnel in secure areas.Look atEnsure logs or schedules confirm that personnel are not working unsupervised in secure areas.GoodThe presence of regular supervision or a working buddy system is documented and consistently followed.
04 - Mappings
link
Cross-framework mappings
How Annex A 7.6 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(15)expand_less | ||
| ISM-0164 | Annex A 7.6 requires security measures to control and protect activities in secure areas, including preventing information exposure durin... | |
| ISM-0225 | Annex A 7.6 requires organisations to design and implement security measures to control and protect how people work within secure areas | |
| ISM-0235 | ISM-0235 prohibits speakerphones on telephone systems in TOP SECRET areas unless the system is in an audio secure room that stays audio s... | |
| ISM-0236 | ISM-0236 requires organisations to implement off-hook audio protection on telephone systems in areas where background conversations may e... | |
| ISM-0559 | Annex A 7.6 requires organisations to implement controls for working in secure areas that prevent compromise of sensitive information and... | |
| ISM-0829 | Annex A 7.6 requires security measures that protect activities conducted in secure areas, including controls to prevent, detect, and resp... | |
| ISM-0931 | ISM-0931 requires that, in SECRET and TOP SECRET areas, push-to-talk handsets or headsets are used to meet off-hook audio protection requ... | |
| ISM-1013 | ISM-1013 requires RF shielding to limit the effective range of SECRET or TOP SECRET wireless networks outside the organisation's area of ... | |
| ISM-1101 | ISM-1101 requires a specific security measure for TOP SECRET environments: terminating cable reticulation systems as close as possible to... | |
| ISM-1103 | Annex A 7.6 requires security measures to control and protect work conducted in secure areas, including protecting supporting infrastruct... | |
| ISM-1450 | Annex A 7.6 requires organisations to implement security measures governing what is permitted when working in secure areas | |
| ISM-2008 | Annex A 7.6 requires organisations to implement security measures governing work practices within secure areas | |
| ISM-2009 | ISM-2009 requires that unauthorised medical devices are not brought into SECRET and TOP SECRET areas, reducing the risk that devices with... | |
| ISM-2069 | Annex A 7.6 requires the design and implementation of security measures that control and protect work within secure areas | |
| ISM-2070 | Annex A 7.6 requires measures to control and protect activities and behaviours within secure areas | |
layersPartially meets(1)expand_less | ||
| ISM-1635 | ISM-1635 requires system owners to implement controls for systems and their operating environments | |
sync_altPartially overlaps(4)expand_less | ||
| ISM-0810 | Annex A 7.6 requires organisations to design and implement security measures for working in secure areas to protect sensitive activities ... | |
| ISM-1137 | ISM-1137 requires system owners of SECRET or TOP SECRET systems to contact ASD for an emanation threat assessment | |
| ISM-1296 | Annex A 7.6 concerns security within secure areas, not public spaces | |
| ISM-1973 | Annex A 7.6 requires organisations to implement security measures governing activities and behaviours when working in secure areas | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Physical controls
Annex A 7.3
Physical Security for Offices and Facilities
Annex A 7.4
Continuous monitoring of physical access to premises
Annex A 7.5
Protecting against physical and environmental threats
Annex A 7.7
Clear desk and clear screen policies
Annex A 7.8
Equipment Siting and Protection
Annex A 7.9
Security of Off-Site Assets
See all Physical controls controls, or browse the full ISO 27001 Annex A library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.