A.7.2
Physical entry
Physical controlsCheckpoints 6Evidence 7Cases 6
Control objective
This control requires that entry to protected areas and facilities be restricted through appropriate entry controls so that only authorized personnel can access each area. The intent is to apply entry procedures and control strength commensurate with the sensitivity of each area, such as office space, computer rooms, and delivery/loading areas, and to retain entry records so that access can be traced afterward. This reduces the risk of exposure, theft, damage, or service disruption caused by unauthorized physical access, and removes control blind spots by identifying, escorting, and supervising visitors and external personnel.
Key checkpoints
- Are entry control mechanisms (access cards, biometrics, locks, and so on) and authentication strength applied differentially according to the sensitivity of each protected area?
- Are the granting, modification, and revocation of entry rights performed through an approval procedure, with rights promptly adjusted upon transfer, resignation, or contract termination?
- Is the entry of visitors and external personnel controlled through identity verification, prior approval, recording of visit purpose, and escort/supervision?
- Are entry records for each area (entry/exit times, identity, and so on) generated, retained, and reviewed periodically?
- Are external-facing points such as delivery/loading areas separated from and controlled apart from internal protected areas?
- Are secondary entry paths (emergency exits, shutters, rear doors) and bypass/unauthorized opening of the entry control system (including tailgating) addressed?
Implementation guidance
- Define entry control levels according to area sensitivity (general office, computer room, communications room, records storage, and so on) and apply authentication means (single/multi-factor) commensurate with each level.
- Grant entry rights minimally on the basis of business need (need-to-enter), and clearly define the request/approval/granting/revocation procedure, owners, and required records.
- Issue visitor badges after prior approval and identity verification, record the purpose/time/host of each visit, and provide continuous escort/supervision in sensitive areas.
- Integrate the entry control system (card readers, biometrics, electronic locks, and so on) with monitoring means (CCTV, alarms) to detect and respond to unauthorized entry and tailgating.
- Retain entry records securely for a defined period and review them periodically to identify abnormal entries (unauthorized attempts, late-night entry, and so on).
- Separate delivery/loading areas so that outsiders cannot enter internal protected areas, and operate inspection and receipt procedures for incoming goods.
- Define prompt recovery and controlled reissuance for lost, damaged, or unreturned entry media. Disable electronic credentials; for mechanical keys, use risk-appropriate rekeying/lock replacement and interim monitoring to prevent residual access.
Evidence
- Definitions of entry control levels and control mechanisms per area
- Records of requesting/approving/granting/modifying/revoking entry rights (rights register)
- Visitor management log (identity verification, visit purpose, badge issuance/return, escort records)
- Entry control system logs (entry/exit records) and results of periodic reviews
- Operation and integration records of monitoring means such as CCTV/alarms
- Inspection/receipt records of incoming goods in delivery/loading areas
- Records of access card/key issuance, return, and loss response
Nonconformity examples
- Access entitlements and authentication strength do not reflect area sensitivity, allowing ordinary visitors or staff into restricted areas without justification.
- Visitors are admitted without identity verification or prior approval, or move unaccompanied in sensitive areas without escort/supervision.
- Entry rights are not revoked after a transfer or resignation, so unnecessary entry rights remain.
- Entry records are not generated, or are not retained/reviewed, making later tracing and identification of abnormal entry impossible.
- No controls exist against tailgating or bypass entry through emergency exits/rear doors.
- Delivery/loading areas are not separated from internal protected areas, allowing outsiders to enter the interior without control.