Key takeaways
- Design physical security for offices and rooms.
- Offices and rooms holding sensitive information need protection matched to their risk.
- Start here: identify rooms with sensitive equipment or information.
Purpose
Design physical security for offices and rooms.
Requirement
Requirement summaryPhysical security for offices, rooms and facilities shall be designed and implemented.
Why it matters
Offices and rooms holding sensitive information need protection matched to their risk.
How to implement
- Identify rooms with sensitive equipment or information.
- Apply locks, restricted signage and access control.
- Keep sensitive screens and documents out of public view.
- Review when office layouts change.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for securing offices and rooms.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.3 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records of who holds keys or door codes for secure rooms.
- Proof door codes are changed when people leave.
Things you should be able to show or explain
- Be able to show that secure rooms are locked and sensitive information can't be seen from outside.
How much to show: A walk-through during the day.
Common mistakes
- Secure rooms left unlocked.
- Sensitive screens visible through windows.
- Server cupboards left unlocked.
- Whiteboards with sensitive data visible from corridors.
- Tip: Don't signpost where the server room is.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.3 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.3?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for securing offices and rooms…