ISO 27001 Annex A 7.6 Security measures for working in secure areas
What it says
Security measures for working in secure areas shall be designed and implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement security measures to control and protect activities in secure areas.
This control is about making sure that any rooms or areas in your business that need to be secure stay that way. It's important because if these areas aren't properly managed, sensitive information or valuable assets can be exposed to damage or theft, leading to financial loss or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Poor control of secure areas can lead to unauthorised access, device misuse, and data breaches, harming reputation and finances.
How to implement
The facilities manager should limit access to secure areas by issuing access cards or keys only to authorised personnel.
They can do this by maintaining a log of who has access and reviewing this regularly to ensure only current employees who need access have it.
The IT manager needs to ensure that any devices taken into secure areas are monitored and controlled.
This can be done by setting up policies that require devices to be registered and checked for any unauthorised recording capabilities that might be used to breach security.
Supervisors should ensure that no one is working alone in secure areas without oversight.
This can be done by implementing a buddy system or scheduling multiple employees to work together in these areas, reducing both safety risks and the opportunity for misconduct.
Security personnel should inspect vacant secure areas regularly to ensure everything is intact and nothing has been tampered with.
This involves setting up a regular inspection schedule and maintaining a checklist of what to look for during these inspections.
The HR department needs to make sure all employees are aware of emergency procedures and restrictions in secure areas.
This can be achieved by holding regular training sessions and displaying procedures prominently within these areas in line with the ISO 27002:2022 guidance.
Keep it running
Audit secure-area work, supervise entry and visitors, restrict devices, and enforce clean-desk, screen-locking, and secure handling/disposal of sensitive media.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request access logs for secure areas.
Look at
Examine the logs to see if they show who accessed the areas and when.
Good evidence
Logs should show that only authorised personnel have accessed the secure areas and that access is logged consistently.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see the policy on carrying and using devices in secure areas.
Look at
Check if the policy outlines clear restrictions and procedures for device registration and monitoring.
Good evidence
The policy should have clear rules that are communicated to employees and provide guidance on how to comply with restrictions.
- Check 3 of 5What an auditor asks for
Ask for
Request the training schedule and materials for personnel working in secure areas.
Look at
Review the schedule to ensure training is regular and materials cover emergency procedures and security protocols.
Good evidence
There should be a well-documented training program with evidence of attendance by all relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Ask for records of inspections of vacant secure areas.
Look at
Look for a detailed inspection schedule and checklists that show inspections are conducted as planned.
Good evidence
Records should confirm that regular inspections occur and note any issues found and resolved promptly.
- Check 5 of 5What an auditor asks for
Ask for
Inquire about the buddy system or supervision logs for personnel in secure areas.
Look at
Ensure logs or schedules confirm that personnel are not working unsupervised in secure areas.
Good evidence
The presence of regular supervision or a working buddy system is documented and consistently followed.
Mappings
Closest match in ASD Information Security Manual: ISM-0164, Prevent unauthorised viewing of system displays, which this control covers in full and more.
ASD Information Security Manual: 20 mappings
This control is broader than ISM-0164.
Annex A 7.6 requires security measures to control and protect activities in secure areas, including preventing information exposure during routine work. ISM-0164 directly relates by requiring prevention of unauthorised observation of systems (e.g. workstation displays and keyboards) within facilities, which is a common secure-area working protection against shoulder-surfing and incidental disclosure. ISM-0164 is a specific visual-security requirement, while Annex A 7.6 is broader and includes additional secure-area measures beyond display protection.
This control is broader than ISM-0225.
Annex A 7.6 requires organisations to design and implement security measures to control and protect how people work within secure areas. ISM-0225 relates by mandating a specific secure-area working rule: preventing unauthorised RF and IR devices from being brought into SECRET and TOP SECRET areas. ISM-0225 is one concrete measure within the broader set of procedural and physical controls envisaged by Annex A 7.6.
This control is broader than ISM-0235.
ISM-0235 prohibits speakerphones on telephone systems in TOP SECRET areas unless the system is in an audio secure room that stays audio secure during conversations with only participating personnel present. This is a specific security measure for working in secure areas, directly contributing to Annex A 7.6 by preventing classified conversations from being overheard. Annex A 7.6 covers all security measures for working in secure areas, whereas ISM-0235 addresses only speakerphone use in TOP SECRET areas.
This control is broader than ISM-0236.
ISM-0236 requires organisations to implement off-hook audio protection on telephone systems in areas where background conversations may exceed the sensitivity/classification the phone system is authorised for. This relates to ISO/IEC 27001:2022 Annex A 7.6 because protecting work practices in secure areas includes preventing inadvertent disclosure through overheard conversations and acoustic leakage from communications devices. Annex A 7.6 is broader (covers general secure-area working measures), while ISM-0236 is a specific technical/operational measure for telephony in those areas.
This control is broader than ISM-0559.
Annex A 7.6 requires organisations to implement controls for working in secure areas that prevent compromise of sensitive information and activities. ISM-0559 relates by prohibiting microphones and webcams with non-SECRET workstations in SECRET areas, limiting audio/visual exfiltration opportunities while staff work in those areas. ISM-0559 is a specific secure-area device restriction encompassed by Annex A 7.6.
This control is broader than ISM-0829.
Annex A 7.6 requires security measures that protect activities conducted in secure areas, including controls to prevent, detect, and respond to security issues while people are working there. ISM-0829 maps to this by requiring measures to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas. ISM-0829 is narrower and device-focused, while Annex A 7.6 is a broader requirement for secure-area working measures overall.
This control is broader than ISM-0931.
ISM-0931 requires that, in SECRET and TOP SECRET areas, push-to-talk handsets or headsets are used to meet off-hook audio protection requirements and prevent unintended audio transmission. This relates to ISO/IEC 27001:2022 Annex A 7.6 because push-to-talk audio controls are a specific security measure that can be implemented when working in secure areas. Annex A 7.6 is broader and can include many other secure-area measures (e.g. entry controls, device restrictions, clear desk), whereas ISM-0931 focuses specifically on mitigating inadvertent audio eavesdropping risks from telephony/headset use.
This control is broader than ISM-1013.
ISM-1013 requires RF shielding to limit the effective range of SECRET or TOP SECRET wireless networks outside the organisation's area of control. Annex A 7.6 requires security measures for working in secure areas, which can include physical and emanations-security protections such as shielding where needed. ISM-1013 is a specific technical/physical countermeasure, whereas Annex A 7.6 is broader and covers a range of secure-area controls beyond wireless containment.
This control is broader than ISM-1101.
ISM-1101 requires a specific security measure for TOP SECRET environments: terminating cable reticulation systems as close as possible to cabinets in server or communications rooms. ISO/IEC 27001:2022 Annex A 7.6 requires organisations to design and implement security measures for working in secure areas, which can include controls to prevent physical tampering or interception of infrastructure such as cabling. ISM-1101 is a single, prescriptive technical/physical measure, while Annex A 7.6 is broader and covers many secure-area working controls.
This control is broader than ISM-1103.
Annex A 7.6 requires security measures to control and protect work conducted in secure areas, including protecting supporting infrastructure in those areas. ISM-1103 relates by specifying a TOP SECRET secure-area implementation detail for cabling: terminating cable reticulation at cabinet boundaries when cabinets are outside server/communications rooms. ISM-1103 is a highly specific physical protection measure within secure areas, and is therefore a subset of the broader Annex A 7.6 requirement.
This control is broader than ISM-1450.
Annex A 7.6 requires organisations to implement security measures governing what is permitted when working in secure areas. ISM-1450 relates by prohibiting microphones and webcams with non-TOP SECRET workstations in TOP SECRET areas, reducing the risk of audio/visual capture in that secure environment. ISM-1450 is a narrowly scoped secure-area device-use restriction that is encompassed by Annex A 7.6.
This control is broader than ISM-2008.
Annex A 7.6 requires organisations to implement security measures governing work practices within secure areas. ISM-2008 relates by defining strict criteria for medical devices that are authorised to be brought into SECRET and TOP SECRET areas, which is a specific secure-area working measure (controlling what equipment can be used while working). ISM-2008 is highly specific to medical-device risk, while Annex A 7.6 is broader and also covers other behaviours, tools and protective procedures in secure areas.
This control is broader than ISM-2009.
ISM-2009 requires that unauthorised medical devices are not brought into SECRET and TOP SECRET areas, reducing the risk that devices with communication or data storage capabilities compromise classified information. This restriction on what may be taken into secure areas is one of the security measures for working in secure areas required by Annex A 7.6. Annex A 7.6 covers all measures for working in secure areas, while ISM-2009 addresses only medical devices in SECRET and TOP SECRET areas.
- ISM-2069Maintain register of authorised recording devices in SECRET and TOP SECRET areasBroader than
This control is broader than ISM-2069.
Annex A 7.6 requires the design and implementation of security measures that control and protect work within secure areas. ISM-2069 relates by requiring an authorised register for photographic and video recording devices in SECRET and TOP SECRET areas, which is a concrete governance mechanism to control use of such devices while working in those areas. ISM-2069 focuses on inventory/authorisation and verification, whereas Annex A 7.6 covers a wider range of secure-area working measures beyond device registers.
This control is broader than ISM-2070.
Annex A 7.6 requires measures to control and protect activities and behaviours within secure areas. ISM-2070 relates by explicitly preventing unauthorised photographic and video recording devices from being brought into SECRET and TOP SECRET areas, controlling a common secure-area threat vector. ISM-2070 is a specific subset of secure-area working measures, while Annex A 7.6 requires a broader suite of protections.
This control partially meets ISM-1635.
ISM-1635 requires system owners to implement controls for systems and their operating environments. Annex A 7.6 focuses on designing and implementing security measures for working in secure areas, which is one environmental control a system owner may need. ISM-1635 is broader because it applies across all environments and across technical and operational controls.
This control partially overlaps ISM-0810.
Annex A 7.6 requires organisations to design and implement security measures for working in secure areas to protect sensitive activities and assets. ISM-0810 relates by mandating that classified systems are housed in facilities meeting a security zone appropriate to their classification, which underpins secure-area operations. ISM-0810 focuses on facility/zone requirements for systems, while Annex A 7.6 focuses on measures that control how work is conducted within those secure areas.
This control partially overlaps ISM-1137.
ISM-1137 requires system owners of SECRET or TOP SECRET systems to contact ASD for an emanation threat assessment. Annex A 7.6 requires security measures in secure areas, encompassing elements such as zoning and equipment placement, influenced by such assessments. While ISM-1137 is about obtaining an assessment, Annex A 7.6 focuses on implementing secure-area controls.
This control partially overlaps ISM-1296.
Annex A 7.6 concerns security within secure areas, not public spaces. ISM-1296's focus on public area devices does not align sufficiently with this specific secure-area requirement.
This control partially overlaps ISM-1973.
Annex A 7.6 requires organisations to implement security measures governing activities and behaviours when working in secure areas. ISM-1973 relates by requiring non-classified systems to be secured in suitably secure facilities, which is part of establishing an environment where secure-area work can occur safely. However, ISM-1973 is primarily about facility suitability for hosting systems, whereas Annex A 7.6 is centred on working controls (procedures, supervision, restrictions) within secure areas.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.