Physical entry

What the requirement asks

Secure areas are to be protected by suitable entry controls and access points. Purpose: allow physical access to information and assets only to those authorized. General guidance: entry points like loading bays and goods-in, and anywhere unauthorized people could get in, are controlled and where possible kept apart from processing facilities. Consider: restricting sites and buildings to authorized people, with physical access rights provided, reviewed, updated and revoked (5.18); recording every entry in a protected paper log or electronic trail that is watched, and safeguarding those logs (5.33) and sensitive authentication information; a process and technical means to govern entry to rooms that hold or process information, using cards, biometrics or two-factor methods such as card plus PIN, and double doors for sensitive areas; a staffed reception or other means of controlling entry; inspecting personal belongings on entry and exit where local law permits; visible identification for everyone, prompt reporting of unescorted or unbadged people, and distinguishable badges for staff, suppliers and visitors; supplier access to secure areas only when needed, authorized and monitored; extra attention in buildings shared with other organizations; measures that can be stepped up when physical risk rises; protecting secondary entrances like fire exits against misuse; and a key management process for physical keys and lock codes or combinations, with a logbook or yearly key audit and controlled access (5.17). Visitors: authenticate their identity, record arrival and departure times, admit them only for specific authorized purposes with briefings on the area's security rules and emergency procedures, and keep them supervised unless expressly exempted. Goods-in areas: restrict outside access to identified, authorized people; design areas so delivery staff cannot reach the rest of the building; secure external doors while inner doors are open; inspect incoming items for explosives, chemicals or other hazards before moving them; register deliveries under asset management (5.9, 7.10); separate incoming and outgoing goods where possible; and check for tampering in transit, reporting any at once to security. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Physical entry is a person-by-person decision. The guidance asks for the authorisation, the visitor record, the escort rule and the review of who still has access.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep physical access rights records with provisioning, periodic review and revocation evidence and one live sample together.

Evidence an assessor asks for

• Physical access controlPhysical access rights records with provisioning, periodic review and revocation evidence
• Physical access controlElectronic access control logs or physical logbooks, protected and monitored
• Physical access controlAccess control system configuration for secure areas, such as card plus PIN or biometrics and double doors
• Physical access controlVisitor logs recording identity checks, arrival and departure, purpose and escort
• Physical access controlKey management records including key registers and annual key audits
• Physical access controlDelivery area procedures and records of inspection, registration and tamper checks on incoming items

The question an assessor will ask

An assessor will ask for physical access rights records with provisioning, periodic review and revocation evidence, then trace it to the system it protects. For A.7.2 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Access badges of leavers remain active
• Visitors move around unescorted and without visible badges
• Emergency exits can be opened from outside or are not alarmed
• Delivery staff can walk from the loading bay into office areas

Before the next audit

Before the next audit, check one live sample for this gap: access badges of leavers remain active.