Securing offices, rooms and facilities

What the requirement asks

The organization is to design and implement physical protection for its offices, rooms and facilities. Purpose: keep intruders out of these spaces and protect the information and assets in them from harm or tampering. Guidance: consider locating critical facilities where the public cannot reach them; where relevant, keeping buildings unobtrusive with minimal indication of their purpose and no obvious signs inside or out that information processing takes place; arranging facilities so confidential information and activities cannot be seen or heard from outside, and considering electromagnetic shielding where appropriate; and keeping directories, internal phone lists and online maps that show where confidential processing facilities are located out of the hands of unauthorized people. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Offices and rooms need protection that matches what is inside. The guidance asks for the zone, the control, the owner and the inspection.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep facility security design documentation showing critical facilities sited away from public access and one live sample together.

Evidence an assessor asks for

• Facility security designFacility security design documentation showing critical facilities sited away from public access
• Facility security designPhotographs or survey records confirming the absence of signage revealing processing facilities
• Facility security designAssessments of visual and acoustic leakage from meeting rooms and processing areas, with mitigations such as window film or sound insulation
• Facility security designElectromagnetic shielding assessments where relevant
• Facility security designControls restricting access to directories, floor plans and online maps showing sensitive facility locations

The question an assessor will ask

An assessor will ask for facility security design documentation showing critical facilities sited away from public access, then trace it to the system it protects. For A.7.3 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Data rooms are labelled or signposted for convenience
• Screens and whiteboards in sensitive rooms are visible from the street
• Internal maps showing server room locations are published on the intranet or public sites
• Critical equipment is placed in areas the public can reach

Before the next audit

Before the next audit, check one live sample for this gap: data rooms are labelled or signposted for convenience.