A.7.1
Physical security perimeters
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
The purpose is to enclose areas that hold information and information processing facilities within clearly defined physical perimeters so that unauthorized physical access, damage, and interference are prevented. The organization should design perimeters in layers according to asset value and assessed risk, keeping the strength of each perimeter proportionate to what it protects. A well-defined perimeter is the physical foundation on which later controls such as entry control, monitoring, and secure-area work depend to be effective.
Key checkpoints
- Are physical perimeters (walls, doors, reception, fencing) clearly defined and documented for areas that contain information processing facilities and sensitive information?
- Are perimeters divided into graded zones (for example general/restricted/controlled) based on asset criticality and risk assessment, with protection levels applied accordingly?
- Are the walls, ceiling, floor, windows, and entry points that form the perimeter physically robust enough to resist unauthorized intrusion?
- Have all openings in the perimeter (doors, emergency exits, windows, cable and duct routes) been identified, each with an appropriate protective measure?
- Is there a procedure to review, approve, and update documentation whenever a perimeter or protected area changes (new installation, relocation, closure)?
- Are locking, detection, and inspection measures in place to maintain perimeter integrity in unattended areas or outside working hours?
Implementation guidance
- Define protected areas from asset criticality and risk assessment, and document the location and protection grade of each physical perimeter in floor plans and a zone inventory.
- Design perimeters as multiple layers rather than a single barrier, so control strength increases as one moves from the outer boundary toward core assets.
- Apply intrusion-resistant materials and construction standards to perimeter structures, and inspect bypass routes such as windows, vents, ceiling voids, and raised-floor spaces.
- Provide reception/control arrangements that verify and record visitors' identities, purpose, and entry authorization. Select onsite staffing, remote reception, or other arrangements according to facility risk and response capability.
- Control unauthorized entry through doors and emergency exits while preserving egress and emergency responder access required by applicable fire and evacuation rules. Verify that locks and alarms do not obstruct evacuation.
- Isolate high-risk areas such as data centers and server rooms within an independent perimeter separated from general office space, and ensure fire, power, and utility routes do not bypass the perimeter.
- Maintain a change history for perimeters and protected areas, and inspect physical condition periodically to remediate damage, deterioration, or bypass paths.
Evidence
- Policy or guideline for designating protected areas and assigning protection grades
- Facility floor plans showing perimeter boundaries and entry points, plus a protected-area inventory
- Physical perimeter inspection checklist and records of periodic inspections
- Review and approval records for perimeter and protected-area changes
- Status records of door/emergency-exit locking and protection of openings
- Operating records for the reception or staffed control point
Nonconformity examples
- The server room sits in the same space as general offices with no separate perimeter, so no physical separation exists.
- The same minimal level of control is applied to all areas, with no grading of protected zones.
- Emergency exits lack adequate protection or monitoring against unauthorized entry, allowing outsiders to bypass the perimeter.
- Bypass routes such as windows, vents, and ceiling voids are omitted from identification and inspection.
- The protected-area floor plan does not match the actual facility and no change history is maintained.
- There is no risk-appropriate means of identifying visitors and recording entry, leaving perimeter access uncontrolled.