A.7.6
Working in secure areas
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires that work performed inside secure areas (computer rooms, communications rooms, records storage, data centers, and so on), such as maintenance, construction, installation, cleaning, visits, and moving items in and out, be governed so that it does not lead to exposure, damage, unauthorized manipulation, or service disruption. Even where physical safeguards such as entry control and perimeters exist, unauthorized actions, photography, media introduction, or arbitrary configuration changes can occur at the moment work actually takes place. The organization should therefore preserve the security level even during work through prior approval, supervision during the work, and retention of work records. By managing the risk of the moment when people and equipment actually intervene in a secure area, this control reinforces the effectiveness of the overall physical security scheme.
Key checkpoints
- Is there a work control procedure that defines, per secure area, the permitted types of work, the approving authority, and the allowed working hours?
- Is work inside secure areas performed only after a prior request/approval process, with the purpose, scope, personnel, and equipment used recorded and managed?
- For external personnel such as maintenance contractors, are identity verification, temporary badge issuance, and continuous escort/supervision applied?
- Are risky actions during work, such as photography, bringing in storage media/personal devices, and unauthorized network connection, notified in advance and controlled?
- Is unattended lone work restricted, and are additional controls applied to work during vulnerable time windows (outside business hours, and so on)?
- After work is completed, are the removal of introduced equipment/media confirmed, temporary changes reverted, and work records reviewed?
Implementation guidance
- Document the permitted work types, approving authority, allowed working hours, and mandatory rules for each secure area, and apply control strength differentially to match the characteristics of each area.
- Require work requests to state the purpose, scope, participating personnel, equipment/media brought in, and expected duration, and allow work to proceed only after prior approval.
- Issue temporary badges to external workers after identity verification, permit work only under the continuous escort/supervision of a responsible person, and recover the badge when work ends.
- Notify in advance the rules to be observed during work, such as restrictions on cameras/personal devices/storage media, prohibition of photography, and prohibition of arbitrary network connection or system manipulation, and set criteria for action upon violation.
- Restrict lone work according to the area's security risks and occupational safety needs. For hazardous work or vulnerable time windows, define suitable safeguards such as two-person work, prior approval, remote supervision, or check-ins, with documented conditions and emergency response.
- On completion, confirm the removal of equipment/media brought in, revert any temporarily granted rights or changed configurations, and review work records (request forms, entry logs, CCTV, and so on) to check for anomalies.
- For repetitive work such as periodic maintenance, standardize the work procedure and approval method, and record work results and exceptions to feed into improvement.
Evidence
- Work control procedure/guideline for secure areas (permitted work, approving authority, rules, and so on)
- Work request/approval records (including electronic approval) and work completion confirmations
- Identity verification materials for external workers, temporary badge issuance/return register, escort/supervision records
- Register of equipment and storage media brought in and out during work
- CCTV footage of the work area, entry logs, and approval records for work during vulnerable windows
- Records of temporary rights/configuration grants and confirmation of their reversion
Nonconformity examples
- A maintenance contractor enters the computer room and performs work without a prior request/approval.
- An external worker enters and works alone in the server room without escort/supervision by a responsible person.
- The work request has no record of the laptop/storage media brought in, so removal cannot be confirmed when work ends.
- A firewall rule opened temporarily or an account right granted during work is not reverted after completion.
- A rule prohibiting photography in secure areas exists, but a worker's mobile phone photography is not actually controlled.
- Lone work is carried out unattended during late-night hours with no control to restrict or supervise it.