.svg)
This article provides a comprehensive, end-to-end explanation of ISO 27001:2022 Annex A 7.2 – Access Control to Premises (Physical Entry). It explains what the control requires, how auditors assess it, how to implement it in practice, how it integrates with the ISMS, and how organisations can maintain compliance at scale.
Understanding ISO 27001 Annex A 7.2
What Annex A 7.2 Covers
Annex A 7.2 focuses on controlling physical entry to secure areas. Its purpose is to prevent unauthorised physical access, damage, or interference with information and information-processing facilities. This includes offices, data centres, server rooms, network closets, archive rooms, and any location where sensitive information is handled, processed, or stored.
The control requires organisations to implement appropriate entry controls, based on risk, to ensure that only authorised individuals can access these areas. These controls must be documented, implemented, monitored, and auditable.
Why Physical Entry Controls Matter in Modern ISMS Programs
Physical access is often the weakest link in security programs. A threat actor does not always need to exploit software vulnerabilities if they can simply walk into a building, tailgate an employee, or access unsecured equipment.
Annex A 7.2 addresses risks such as:
- Theft or tampering with physical assets
- Unauthorised access to systems via local ports
- Exposure of confidential paper records
- Insider threats enabled by uncontrolled access
- Breaches caused by visitors, contractors, or shared spaces
By enforcing physical entry controls, organisations protect the confidentiality, integrity, and availability (CIA) of information at the most fundamental level.
Relationship to the Physical Controls Domain
Annex A 7.2 sits within the Physical Controls category of ISO 27001:2022. While many organisations associate ISO 27001 primarily with digital controls, physical controls are equally critical.
Annex A 7.2 works closely with:
- Physical security perimeters
- Equipment security
- Secure disposal
- Environmental protections
- Personnel security controls
Together, these controls ensure that physical environments do not undermine the effectiveness of technical or organisational safeguards.
What ISO 27001 Annex A 7.2 Requires
Core Requirement Explained
ISO 27001 Annex A 7.2 requires organisations to:
- Define secure areas
- Control physical entry points
- Authorise access based on role and need
- Prevent unauthorised access
- Monitor and record access
- Protect access records
- Review and revoke access when required
The control does not prescribe specific technologies. Instead, it mandates a risk-based approach, allowing organisations to select controls appropriate to their environment, size, and threat profile.
Identifying Secure Areas
The first step in implementing Annex A 7.2 is identifying which areas require controlled access. Secure areas are not limited to server rooms or data centres.
Examples include:
- Corporate offices
- Shared workspaces
- R&D labs
- HR or finance departments
- Archive rooms
- Network cabinets
- Cloud provider cages
- Remote or satellite offices
Each secure area must be defined within the ISMS scope and linked to asset and risk registers.
Authorised vs Unauthorised Access
Annex A 7.2 requires organisations to distinguish clearly between authorised and unauthorised individuals.
Authorised individuals may include:
- Employees
- Contractors
- Temporary staff
- Approved visitors
- Maintenance personnel
Authorisation must be documented, role-based, and reviewed regularly. Access should never be implicit or assumed.
Physical Entry Controls in Practice
Types of Physical Access Controls
Organisations may implement a combination of physical, technical, and procedural controls to meet Annex A 7.2 requirements.
Common examples include:
- Mechanical locks and keys
- Electronic access cards
- PIN codes
- Biometric authentication
- Security guards
- Turnstiles
- Mantraps
- CCTV systems
- Intrusion detection systems
Controls should be layered, ensuring that failure of one mechanism does not result in unrestricted access.
Visitor Management Requirements
Visitor access is one of the most common sources of audit findings.
A compliant visitor management process typically includes:
- Pre-approval of visits
- Identity verification on arrival
- Visitor registration
- Issuing temporary badges
- Escorting visitors in secure areas
- Logging entry and exit times
- Returning badges on exit
Visitor logs must be protected, retained, and reviewed as part of ISMS monitoring.
Managing Contractors and Third Parties
Contractors and third parties often require access to secure areas but present increased risk due to limited organisational oversight.
Annex A 7.2 requires organisations to:
- Authorise contractor access explicitly
- Limit access to required areas only
- Time-bound access permissions
- Supervise or escort where appropriate
- Revoke access promptly when contracts end
These requirements align closely with supplier security and personnel screening controls.
Risk-Based Design of Physical Entry Controls
Applying Risk Assessments to Physical Access
ISO 27001 requires controls to be selected based on risk assessment outcomes. Physical entry controls must therefore reflect:
- Sensitivity of information
- Criticality of systems
- Threat likelihood
- Impact of unauthorised access
For example, a publicly accessible office may require lighter controls than a data centre hosting regulated customer data.
Zoning and Access Segmentation
Many organisations implement security zones to align controls with risk levels.
Typical zones include:
- Public areas
- General office areas
- Restricted areas
- Highly restricted areas
Each zone has progressively stronger access controls, reducing unnecessary exposure while maintaining operational efficiency.
Shared Offices and Co-Working Environments
Shared spaces introduce unique challenges for Annex A 7.2 compliance.
Organisations using co-working environments must:
- Clearly define their controlled areas
- Implement access segregation
- Secure equipment and documents
- Manage visitor access within shared premises
- Document compensating controls
Auditors will assess whether physical risks in shared environments have been adequately identified and treated.
Monitoring, Logging, and Evidence
Access Logs and Audit Trails
ISO 27001 Annex A 7.2 requires organisations to maintain records of physical access where appropriate.
These records may include:
- Badge access logs
- Visitor sign-in logs
- CCTV footage
- Security incident reports
Logs must be protected from unauthorised access and tampering, retained for defined periods, and available for audit.
CCTV and Surveillance Considerations
CCTV can be an effective supporting control but must be implemented carefully.
Organisations must consider:
- Privacy and data protection laws
- Purpose limitation
- Retention periods
- Access restrictions
- Signage and transparency
CCTV should support, not replace, access control mechanisms.
Protecting Access Records
Access records themselves are sensitive information and must be protected under the ISMS.
Controls should ensure:
- Restricted access to logs
- Integrity of records
- Secure storage
- Defined retention and disposal policies
Failure to protect access logs is a common audit finding.
Integration with Other ISO 27001 Controls
Relationship with Personnel Security Controls
Annex A 7.2 works closely with personnel security controls such as employee screening, onboarding, and disciplinary processes.
Access to premises must align with:
- Employment status
- Role changes
- Disciplinary actions
- Termination processes
Physical access should be revoked promptly when personnel leave or change roles.
Alignment with Asset Management
Physical access controls must reflect asset ownership and classification.
Sensitive assets should be located in appropriately secured areas, with access limited to authorised asset owners or custodians.
Incident Management and Physical Breaches
Physical security incidents must be handled through the organisation’s incident management process.
Examples include:
- Lost access cards
- Forced entry
- Tailgating incidents
- Visitor violations
Incidents should trigger investigation, corrective actions, and updates to risk assessments.
Auditor Expectations for Annex A 7.2
What Auditors Look For
During ISO 27001 audits, auditors typically assess:
- Defined secure areas
- Documented access control procedures
- Evidence of access authorisation
- Visitor management records
- Physical access logs
- Monitoring mechanisms
- Review and revocation processes
Auditors will also conduct walkthroughs to validate that documented controls reflect reality.
Common Nonconformities
Frequent findings include:
- Uncontrolled visitor access
- Missing or incomplete visitor logs
- Shared access cards
- Access not revoked for leavers
- Lack of monitoring or review
- Poor alignment between documentation and practice
Avoiding these issues requires ongoing operational discipline.
Maintaining Compliance Over Time
Reviewing Physical Access Regularly
Physical access controls must be reviewed periodically to ensure continued effectiveness.
Reviews may be triggered by:
- Organisational changes
- Office moves
- New facilities
- Incidents
- Audit findings
- Changes in risk profile
Regular reviews help ensure controls evolve alongside the business.
Managing Changes to Premises
Any change to physical premises should trigger reassessment under the ISMS.
This includes:
- Renovations
- New offices
- Expansion
- Downsizing
- Relocation
Failure to update access controls during changes is a major source of risk.
Training and Awareness
Employees must understand their responsibilities regarding physical security.
Awareness activities should cover:
- Badge usage
- Tailgating prevention
- Visitor handling
- Incident reporting
Human behaviour is a critical component of physical security effectiveness.
Best Practices for Implementing Annex A 7.2
Centralising Access Management
Using centralised systems for managing access improves consistency, visibility, and auditability.
Benefits include:
- Easier reviews
- Faster revocation
- Better reporting
- Reduced errors
Documenting Exception Handling
Not all access scenarios fit standard processes.
Organisations should document:
- Temporary access procedures
- Emergency access
- Maintenance access
- Executive exceptions
All exceptions must be justified, approved, and time-bound.
Testing Physical Controls
Testing ensures controls work as intended.
Examples include:
- Access reviews
- Tailgating tests
- Badge deactivation tests
- Incident simulations
Testing demonstrates proactive security management to auditors.
Why Annex A 7.2 Matters
ISO 27001 Annex A 7.2 is not simply about doors and locks. It is about establishing trust boundaries in the physical world, ensuring that sensitive information and systems are protected from unauthorised physical access.
A mature implementation integrates physical access controls into the broader ISMS, aligns them with risk assessments, supports audit readiness, and evolves alongside organisational change. Organisations that treat physical security as an afterthought often discover weaknesses too late — during audits or after incidents.
Strengthen Physical Access Governance with Hicomply
Managing physical access controls, evidence, reviews, and audits manually becomes increasingly difficult as organisations grow, expand locations, and onboard third parties.
Hicomply helps organisations centralise ISMS governance, track access controls, maintain evidence, manage reviews, and demonstrate compliance with ISO 27001 Annex A 7.2 — without spreadsheets or fragmented tools.
If you want to simplify physical security compliance, reduce audit risk, and maintain continuous ISO 27001 alignment, book a demo with Hicomply to see how your ISMS can be managed more effectively.
