Auditing Annex A.7: Physical Controls

A.7 has fourteen controls covering perimeters, entry, secure areas, environmental threats, equipment and disposal. It is the one theme where the strongest evidence is something you can see, and the theme most often audited badly — by walking a building and admiring the locks rather than testing what the organisation said it would do.

The organisation in the worked findings on this page is invented, and so are the findings.

The fourteen ISO 27001 Annex A.7 physical controls, by control number

Remember where the control came from. Annex A is a reference set, and a control is on the audit’s agenda because the organisation selected it at Clause 6.1.3 and recorded that in the Statement of Applicability. What that document claims is the first thing to test. It is worth doing here in particular: physical arrangements are inherited, and an organisation frequently has protection it never selected and never wrote down.

What an ISO 27001 physical controls audit is actually testing

Not whether the building is secure. Whether the arrangements the organisation determined it needed are the ones in place. A building with card readers, cameras and a manned reception can fail A.7 comfortably, if what its own policy says about secure areas is not what the secure areas do. And a modest office with two locked rooms can pass, if the two rooms are the ones its risk assessment identified and the arrangements match.

That has a practical consequence for the order of work. Read before you walk. The site plan, the definition of secure areas, the entry rules, the maintenance schedule and the disposal arrangements are all documents, and they become your criteria. Walking first produces observations you have nothing to measure against, and an auditor with observations and no criteria writes opinions.

Where ISO 27001 Annex A.7 is usually strong, and where it is usually thin

Physical security is the oldest discipline in the annex, and most organisations have inherited arrangements that work. The perimeter, the entry system and the server room are normally in reasonable order, and a great deal of audit time gets spent confirming it.

The thin ground is elsewhere, in four controls that rarely get attention.

A.7.11 supporting utilities. An uninterruptible power supply and a generator are common; records that either has been tested under load are not. The control asks for protection from failures in supporting utilities, and untested protection is an assumption.

A.7.13 equipment maintenance. Maintenance is normally somebody else’s schedule — facilities, or a contractor. The information security question is whether it happens as specified, and what the engineer has access to while it does.

A.7.12 cabling security. Almost never examined, and the one control in the theme where a fifteen-second look at a comms room usually settles it.

A.7.9 security of assets off-premises. Written for laptops in an era before most of the workforce was off-premises most of the time. Read the organisation’s own arrangements and test them against how people actually work.

Two worked ISO 27001 findings on Annex A.7, from one visit

Wraysbury Castings operates two foundries and a head office, with a server room at head office protected by card entry and an environmental monitoring system.

The same afternoon in the facilities office produced two findings. They are set out separately because they are two requirements, resting on different evidence and needing different corrective action. Bundling them into one nonconformity would have given the organisation a single response to write and one of the two problems would have survived it.

The first: A.7.11

The second: A.7.13

Note that the two findings are graded differently on evidence gathered the same afternoon. That is not inconsistency. The first says a whole class of protection has never been verified in the way the organisation itself specified; the second says one machine is overdue for a service inside a regime that is otherwise running. Grading both major because they came from the same afternoon, or both minor because they are both about facilities, would be grading by circumstance rather than by evidence.

And notice where the criteria came from in each. Not from a view about how often a generator ought to be tested or a sensor serviced — the standard says nothing about either, and an auditor who supplies a figure has invented a requirement. The criteria are the organisation’s own procedure, which is exactly what makes both findings hard to argue with.

One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. Causes are the organisation’s to establish under Clause 10.2, and supplying one hands the auditee something to argue about instead of something to answer. The facilities manager’s account of the lapse and the replacement is recorded because it bears on reach and on grade: it establishes that the gap is one item rather than a regime, and it tells you what to ask next, which is what else that contract covered. Note that it is recorded as what he said, not adopted as the reason the lapse happened.

Observation in an ISO 27001 audit, and its limits

Physical controls produce the one kind of evidence nobody prepared for you, and that makes observation valuable. It also makes it easy to over-read.

What an observation gives you is a fact at a moment. A network switch sitting on a shelf in an unlocked storeroom is a fact about that switch at that time. It becomes a finding when you can say what requirement it breaches — here A.7.8, equipment sited securely and protected — and show that it is not a moment. An auditor who writes up a single observation as a control failure will be told, fairly, that it was a one-off, and will have nothing to answer with.

So pair every observation with a document or a record. Ask what the siting requirements are and whether that storeroom is inside them; ask when the site was last walked against those requirements and by whom, and read what they wrote. If the last walk recorded no exceptions, you have moved from an anecdote about a switch to something about the checking. If there has never been a walk, you have moved somewhere else again.

Major or minor in ISO 27001 Annex A.7

Major territory: protection the organisation relies on that has never been verified; equipment disposed of with no assurance about what was on it; siting and cabling requirements the organisation set and applied nowhere.

Minor territory: one maintenance visit late in an otherwise maintained schedule; one asset off-premises without the recorded authorisation the procedure asks for; one item sited outside the requirements where the rest of the site meets them.

Escalation: physical failures in several unrelated controls at the same site usually mean nobody owns physical security, which is worth pursuing at A.5.2 or Clause 5.3 rather than as a run of separate minors.

A last word on what this page is not. Fourteen controls is not fourteen inspections. The temptation in a physical audit is to see everything and test nothing, because everything is visible. Choose the controls the organisation’s own risk assessment and Statement of Applicability point you at, and follow each one from its requirement to its record to the thing itself.

Frequently asked questions about ISO 27001 Annex A.7

The other three ISO 27001 Annex A themes

the A.5 organizational controls

the A.6 people controls

the A.8 technological controls

practice questions on Annex A

For the requirements these controls sit alongside, which record evidences which clause matches each clause to the record that evidences it, and the clause map for lead auditors sets out the whole of Clauses 4 to 10.

3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.