Physical security perimeters

What the requirement asks

The organization is to define security perimeters and use them around areas holding information and other associated assets. Purpose: keep unauthorized people out and prevent physical harm to or tampering with the organization's information and assets. Guidance: where appropriate, define each perimeter and decide its location and strength according to the security requirements of the assets inside; make the perimeter of a building or site containing processing facilities physically sound, with no gaps or easy break-in points, solid exterior roofs, walls, ceilings and floors, external doors protected by bars, alarms, locks or similar, doors and windows locked when unattended, added outside protection considered for windows, above all on the ground floor, and ventilation openings taken into account; and alarm, monitor and test every fire door in a perimeter together with the walls so the required resistance is achieved to suitable standards, with the doors failing safe. Other information: protection comes from one or more barriers around the premises and facilities; a secure area might be one lockable office or a group of rooms inside a continuous internal barrier; extra internal barriers may separate areas with different requirements; and measures should be capable of being strengthened when threat levels rise. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Physical perimeters should be visible and tested. The guidance asks for the boundary, the entry points, the controls and the inspection record.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep site plans showing defined security perimeters and their strength relative to the assets inside and one live sample together.

Evidence an assessor asks for

• Physical perimeterSite plans showing defined security perimeters and their strength relative to the assets inside
• Physical perimeterPhysical security surveys or assessments of walls, roofs, floors, doors, windows and vents
• Physical perimeterRecords of external door protection such as locks, bars and alarms
• Physical perimeterAlarm, monitoring and test records for perimeter fire doors, including fail-safe operation
• Physical perimeterProcedures for locking doors and windows when areas are unattended
• Physical perimeterPlans for strengthening physical measures during heightened threat

The question an assessor will ask

An assessor will ask for site plans showing defined security perimeters and their strength relative to the assets inside, then trace it to the system it protects. For A.7.1 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• False ceilings or raised floors let people bypass walls around secure rooms
• Fire doors on the perimeter are propped open or not alarmed
• Ground-floor windows and ventilation ducts are unprotected
• Perimeters are not reassessed after building alterations

Before the next audit

Before the next audit, check one live sample for this gap: false ceilings or raised floors let people bypass walls around secure rooms.