Working in secure areas

What the requirement asks

Security measures for working inside secure areas are to be designed and put in place. Purpose: stop the people who work in secure areas from damaging or tampering with the information and assets held there. Guidance: the measures apply to all personnel and to every activity in the secure area. Consider telling people that a secure area exists, or what happens in it, only when they need to know; avoiding unsupervised work there, for safety and to reduce the opportunity for malicious acts; locking vacant secure areas and inspecting them periodically; banning photographic, video, audio and other recording equipment, including cameras on user devices, unless authorized; controlling how user endpoint devices are brought in and used; and displaying emergency procedures where they can be seen or easily reached. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Secure areas need rules that are followed. The guidance asks for the entry, the behaviour, the supervision and the record.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep documented rules for working in secure areas that apply to all personnel and activities and one live sample together.

Evidence an assessor asks for

• Secure area rulesDocumented rules for working in secure areas that apply to all personnel and activities
• Secure area rulesRecords restricting knowledge of secure areas to those with a need to know
• Secure area rulesSupervision or two-person rules and records for work in secure areas
• Secure area rulesInspection records for vacant secure areas and evidence they are locked
• Secure area rulesA policy and signage prohibiting unauthorized recording devices, with authorization records for exceptions
• Secure area rulesVisible or readily accessible emergency procedures in each secure area

The question an assessor will ask

An assessor will ask for documented rules for working in secure areas that apply to all personnel and activities, then trace it to the system it protects. For A.7.6 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Staff routinely take phones with cameras into secure areas without authorization
• Work in data rooms is done alone out of hours with no supervision
• Vacant secure rooms are left unlocked
• Floor plans and descriptions of secure areas circulate widely

Before the next audit

Before the next audit, check one live sample for this gap: staff routinely take phones with cameras into secure areas without authorization.