# Physical Security Policy: [Organization name] > Topic-specific policy that sets the physical and environmental > security rules for every site, room, piece of equipment and storage > medium inside the ISMS scope. It supports ISO/IEC 27001:2022 + Amd > 1:2024 Annex A theme A.7 (physical controls A.7.1 to A.7.14), with > implementation guidance in ISO/IEC 27002:2022. Clear desk rules > (A.7.7) and disposal records (A.7.14) have their own documents and > are summarised here. Replace every `[bracketed]` value and every row > marked *Example*. ## Document control | Field | Value | |---|---| | Document ID | DOC-ISMS-055 | | Version | [1.0] | | Status | [Draft / In review / Approved / Superseded] | | Owner | [@facilities-security-lead] | | Approvers/reviewers | [@isms-manager], [@ciso], [@head-of-facilities], [@hr-lead] | | Last updated | YYYY-MM-DD | | Classification | [Internal] | | Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, Annex A A.7.1 to A.7.14; ISO/IEC 27002:2022 | | Next scheduled review | YYYY-MM-DD (at least annually and after any site change) | | Sites covered | [Site register in section 4.1] | | Parent policy | DOC-ISMS-001 Information security policy | | Related documents | DOC-ISMS-056 Clear desk and clear screen policy; DOC-ISMS-057 Equipment disposal and reuse record; DOC-ISMS-079 Data centre and colocation assessment; DOC-ISMS-054 Remote working policy | ### Approvals | Role | Name | Decision | Date | |---|---|---|---| | Policy owner | [@facilities-security-lead] | [Prepared] | YYYY-MM-DD | | ISMS manager | [@isms-manager] | [Reviewed] | YYYY-MM-DD | | Top management | [@coo] | [Approved / Approved with changes] | YYYY-MM-DD | ### Revision history | Version | Date | Author | Change | |---|---|---|---| | 1.0 *(Example)* | YYYY-MM-DD | [@facilities-security-lead] | First issue for Stage 1 audit | | 1.1 *(Example)* | YYYY-MM-DD | [@facilities-security-lead] | Added second office and colocation suite to the site register; CCTV retention changed to 30 days | ## Contents 1. Purpose, scope and applicability 2. Policy principles 3. Roles and responsibilities 4. Site register and security zones 5. Perimeters, entry controls and visitors (A.7.1, A.7.2) 6. Secure offices, rooms and working in secure areas (A.7.3, A.7.6) 7. Physical security monitoring (A.7.4) 8. Physical and environmental threats (A.7.5) 9. Equipment siting, utilities, cabling and maintenance (A.7.8, A.7.11, A.7.12, A.7.13) 10. Off-premises assets, storage media, disposal and clear desk (A.7.7, A.7.9, A.7.10, A.7.14) 11. Facilities run by third parties 12. Size tiers 13. Control mapping 14. Exceptions, compliance and review 15. Records and evidence 16. References ## 1. Purpose, scope and applicability This policy sets the rules that keep people who have no business need out of the places where [Organization name] holds information and equipment, and that protect those places and that equipment against fire, water, power loss, theft and tampering. It covers: - every site listed in the site register (section 4.1), including shared offices, plants, warehouses and colocation suites; - equipment owned or leased by the organization wherever it is used, including laptops, phones, removable media and network equipment; - printed information and other non-electronic media; - all employees, contractors, temporary staff, visitors, cleaners, maintenance engineers and suppliers who enter a site or handle equipment in scope. Data centres operated by cloud providers are covered through supplier assurance (A.5.19 to A.5.23) rather than through direct physical rules: section 11 explains how. Out of scope: [list any site or area excluded from the ISMS scope, with the reason recorded in DOC-ISMS-002]. ## 2. Policy principles 1. **Defence in depth.** Information and equipment are protected by layered zones. The more sensitive the asset, the more layers a person crosses to reach it. 2. **Least physical access.** Access to each zone is granted on a business need, approved by the zone owner and removed when the need ends. 3. **Every entry is attributable.** Entry to restricted and secure zones is logged to a person, not to a shared badge or code. 4. **Visitors are escorted.** Anyone without an access right is signed in, identified, badged and escorted in restricted zones. 5. **Risk-based protection.** Environmental and utility protection is sized to the risk assessment (DOC-ISMS-010), including climate related hazards identified under clause 4.1. 6. **Equipment is tracked through its life.** Every asset that holds information is in the asset inventory (DOC-ISMS-012) from receipt to verified sanitisation or destruction. 7. **Assurance where we do not operate.** Where a landlord, colocation provider or cloud provider runs the facility, the organization obtains and reviews evidence that the provider's controls work. ## 3. Roles and responsibilities | Role | Responsibilities | |---|---| | Top management | Approves this policy and the resources for physical protection | | Policy owner (facilities security lead) | Maintains the policy, site register and zone model; runs the annual physical security review | | ISMS manager | Links physical risks to the risk register, tracks findings, includes physical topics in internal audit and management review | | Site manager (one per site) | Applies the policy at the site, owns the visitor log, coordinates landlord and building services | | Zone owner | Approves access requests for the zone, reviews the access list each quarter | | IT operations | Owns server rooms, network cabinets and cabling; manages equipment siting, maintenance and media handling | | Security operations or monitoring lead | Reviews alarms, badge exceptions and CCTV as part of monitoring (A.7.4) | | HR | Triggers badge issue and revocation through joiner, mover and leaver processes | | All personnel | Wear badges, challenge unbadged people, prevent tailgating, report incidents and lost badges at once | | Reception or security guard service | Signs in visitors, issues visitor badges, enforces escort rules | ## 4. Site register and security zones ### 4.1 Site register | Site ID | Site | Type | Operated by | Highest zone | Site manager | In ISMS scope | |---|---|---|---|---|---|---| | SITE-001 *(Example)* | Head office, floor 3 | Leased shared office | Landlord (perimeter), organization (floor) | Z3 network cabinet room | [@office-manager] | Yes | | SITE-002 *(Example)* | Colocation suite, cage 14 | Colocation | Provider (building, power, cooling), organization (cage and racks) | Z4 cage | [@it-ops-lead] | Yes | | SITE-003 *(Example)* | Plant 2 | Owned industrial site | Organization | Z4 OT control room | [@plant-manager] | Yes | | [SITE-NNN] | [name] | [type] | [operator] | [zone] | [@owner] | [Yes / No, reason] | ### 4.2 Zone model | Zone | Name | Typical areas | Minimum entry control | Monitoring | |---|---|---|---|---| | Z0 | Public | Street, car park, shared lobby | None | Landlord or public CCTV where present | | Z1 | Reception | Reception desk, visitor waiting area | Staffed reception or intercom during opening hours | Visitor log, CCTV on entrance | | Z2 | General office | Open office, meeting rooms, kitchens | Personal badge; visitors escorted | Badge log; intruder alarm out of hours | | Z3 | Restricted | Network cabinet rooms, HR file rooms, print rooms with confidential output, OT engineering rooms | Personal badge with role-based access list; visitors escorted at all times | Badge log reviewed monthly; door-held and forced alarms | | Z4 | Secure | Server rooms, colocation cages, OT control rooms, safes for keys and media | Badge plus second factor (PIN or biometric) or key held by named custodians; access list approved by zone owner | Badge log reviewed weekly; CCTV on door and inside; alarms monitored | ```mermaid flowchart LR Z0["Z0 Public"] --> Z1["Z1 Reception: sign-in"] Z1 --> Z2["Z2 General office: personal badge"] Z2 --> Z3["Z3 Restricted: role-based badge"] Z3 --> Z4["Z4 Secure: badge plus PIN or key"] Z1 -. "Visitor badge and escort" .-> Z2 ``` Each move to a higher zone needs a separate access decision. Do not let a Z2 badge open a Z3 door by default. ## 5. Perimeters, entry controls and visitors (A.7.1, A.7.2) ### 5.1 Perimeters (A.7.1) - Define the perimeter of each site and each zone on a floor plan kept with the site register. - External doors, ground-floor windows and roof access are secured, alarmed out of hours or both. Fire exits cannot be opened from the outside and raise a local or monitored alarm when opened. - Delivery and loading areas are separated from Z2 and higher zones, so deliveries do not give access to the office. - In shared buildings, record in section 11 which perimeter controls the landlord provides and how you check them. ### 5.2 Entry controls (A.7.2) - Personal badges are issued only after HR confirms the start date and the onboarding checklist (`ops/onboarding-checklist`) is complete. - Badges show no organization name or site address on the outside. - Access rights follow the zone model. Z3 and Z4 rights are requested through a ticket, approved by the zone owner and reviewed each quarter (`ops/access-review`). - Leavers' badges are disabled on the last working day, ideally by an automated feed from HR, and collected with other assets (A.5.11). Lost badges are reported and disabled the same day. - Anti-tailgating: personnel do not hold doors to Z3 or Z4 for others. Where tailgating is a recorded risk, install turnstiles, mantraps or door-held alarms. - Shared PIN codes and mechanical keys are a last resort. Where used, keep a key register, change codes at least [every 6 months] and after any leaver who knew them. ### 5.3 Visitors - Visitors sign in at reception with name, organization, host, time in and time out. Electronic visitor systems must protect visitor personal data and keep it only for [90 days] unless an incident requires longer. - Visitors wear a visible visitor badge and are escorted in Z2. In Z3 and Z4 an authorised person escorts them at all times and the visit is logged in the zone log. - Visitors sign or accept the site rules (and a confidentiality agreement, DOC-ISMS-051, where they may see confidential information). - Maintenance engineers and cleaners with regular access are treated as personnel with a limited badge, screened according to DOC-ISMS-050 where the risk requires. - Uncollected visitor badges at the end of the day are disabled and followed up with the host. ## 6. Secure offices, rooms and working in secure areas (A.7.3, A.7.6) ### 6.1 Securing offices, rooms and facilities (A.7.3) - Sensitive rooms carry no sign that shows their purpose. Internal directories and floor plans that show Z3 and Z4 rooms are classified Internal or higher. - Rooms where confidential discussions take place are not overlooked from outside. Use blinds or window film where screens or whiteboards face a public area. - Z3 and Z4 rooms stay locked when not occupied. Keys and access cards for these rooms are held by named custodians. - Printers that handle confidential output use pull printing or sit in a Z3 print room. ### 6.2 Working in secure areas (A.7.6) - Only work that needs the secure area takes place there. No lone working in Z4 without a check-in arrangement where safety requires. - No food, drink, combustible packaging or personal storage in server rooms and OT control rooms. - Photography and video recording in Z4 require the zone owner's approval. Personal recording devices are restricted where [classification or contract] requires it. - Unattended secure areas are locked and checked. Empty secure areas are inspected [monthly] for unused equipment and stored material. - Third-party engineers in Z4 are escorted unless they hold an approved unescorted right recorded in the access list. ## 7. Physical security monitoring (A.7.4) Watching the sites matters because locks and badges only work if someone notices when they fail, and visible monitoring also puts people off trying. It combines the following sources, chosen per zone in section 4.2: | Source | What it detects | Reviewed by | Review frequency | Retention | |---|---|---|---|---| | Intruder alarm | Entry outside opening hours | Alarm receiving centre or on-call | On each alarm | Alarm log [12 months] | | Door alarms (forced, held open) | Forced doors, tailgating, propped doors | Security operations | On each alarm, trend monthly | [12 months] | | Badge access logs | Who entered which zone and when | Zone owner (Z3 monthly, Z4 weekly) | As in zone model | [12 months] | | CCTV | Entry and activity at entrances and Z4 doors | Security operations on alert or incident | On alert, spot check [monthly] | [30 days] unless held for an investigation | | Guard patrols (larger sites) | Physical anomalies, unlocked doors | Site manager | Each shift report | [12 months] | | Environmental sensors | Temperature, humidity, water, smoke in Z4 | IT operations | Continuous with alerts | [12 months] | Rules: - Monitoring systems are protected against tampering and their clocks are synchronised with the organization's time source (A.8.17) so that badge, CCTV and system logs can be correlated. - CCTV is placed and signed in line with applicable privacy law (for example GDPR in the EU) and does not cover private areas such as washrooms. A privacy assessment (`compliance/dpia`) is done before a new CCTV system is installed where the law requires. - Physical security alerts that may affect information are reported through DOC-ISMS-023 and handled under DOC-ISMS-020. - Monitoring results feed the measurement programme: alarms per month, door-held events, unreviewed access lists and time to revoke leaver badges. ## 8. Physical and environmental threats (A.7.5) - Assess physical and environmental threats for each site when it is added and at least every [2 years], recording risks in the risk register (DOC-ISMS-016). Consider location (flood plains, coastal storm exposure, seismic zones, wildfire areas), building type, neighbours and the history of incidents. - Where the context review (DOC-ISMS-003) finds climate change to be a relevant issue, include rising flood, heat and storm risks and how they affect cooling, power and staff access. - Fire: detection in all zones; suppression in Z4 suitable for electrical equipment; extinguishers checked as local fire rules require; fire drills with the result recorded. - Water: no water pipes above Z4 equipment where avoidable; leak detection under raised floors and near cooling units; equipment kept off the floor in flood-prone areas. - Heat and humidity: environmental monitoring with alert thresholds in Z4 (section 9.2). - Deliberate attack and unrest: entry controls (section 5), glazing and lighting proportionate to the site risk. - Business continuity: site loss scenarios are part of the business impact analysis (`compliance/business-impact-analysis`) and ICT readiness plan (DOC-ISMS-047). ## 9. Equipment siting, utilities, cabling and maintenance (A.7.8, A.7.11, A.7.12, A.7.13) ### 9.1 Equipment siting and protection (A.7.8) - Servers, network devices and OT controllers sit in Z3 or Z4 in locked racks or cabinets. - Screens that show confidential information are placed so they cannot be read from public areas or through windows. - Equipment is kept away from water, heat sources, direct sunlight and heavy foot traffic. ### 9.2 Supporting utilities (A.7.11) | Utility | Minimum requirement | Test | Owner | |---|---|---|---| | Power | UPS sized for [15 minutes] of Z4 load; generator where the BIA recovery time needs it | UPS self-test [monthly], load test [annually], generator run [monthly] | [@it-ops-lead] | | Cooling | Capacity with redundancy for Z4 rooms; alert at [27 C] inlet temperature *(Example threshold, align with equipment specification)* | Service [twice a year] | [@facilities] | | Telecoms | Two diverse network links for sites that host production or OT | Failover test [annually] | [@network-lead] | | Water and drainage | Leak detection in Z4 | Sensor test [twice a year] | [@facilities] | ### 9.3 Cabling security (A.7.12) - Power and data cabling between zones runs in conduits, trunking or ceiling spaces that are not accessible from Z0 or Z1. - Patch panels and network cabinets are locked and labelled with codes that do not reveal their purpose to an outsider. - Unused network ports in Z1 and meeting rooms are disabled or placed on a guest network (DOC-ISMS-063). - Cabling changes are made through change management (`ops/change-request`) and cable plans are kept current. ### 9.4 Equipment maintenance (A.7.13) - Maintain equipment according to the supplier's recommended intervals and record each service in a maintenance log. - Only authorised engineers perform maintenance. Remote maintenance sessions are approved and logged. - Before equipment leaves the site for repair, remove or sanitise storage media, or use a supplier contract that covers confidentiality and on-site media retention. - After maintenance, check that the equipment works and that no unauthorised changes were made. ## 10. Off-premises assets, storage media, disposal and clear desk (A.7.7, A.7.9, A.7.10, A.7.14) - **Clear desk and clear screen (A.7.7):** rules, checks and metrics are in DOC-ISMS-056 (`isms/clear-desk-clear-screen-policy`). - **Assets used off-premises (A.7.9):** laptops and phones are encrypted and managed (DOC-ISMS-058); equipment is never left unattended in vehicles or public places; equipment taken to high-risk destinations follows the travel rules in DOC-ISMS-054. Equipment that stays off-premises permanently (home office equipment) is listed in the asset inventory with its location type. - **Storage media (A.7.10):** removable media is allowed only where [business need, approved list]; confidential information on removable media is encrypted; media is labelled according to DOC-ISMS-042 and stored in a locked Z3 cabinet or safe; media in transit uses approved couriers with tracking. - **Secure disposal or reuse (A.7.14):** before reuse or disposal, storage is sanitised or destroyed and the result recorded in DOC-ISMS-057 (`isms/equipment-disposal-reuse-record`), following `data/data-retention-deletion-standard` for retention decisions. ## 11. Facilities run by third parties | Facility type | Who operates what | How assurance is obtained | |---|---|---| | Shared office building | Landlord runs lobby, perimeter doors, building alarm, fire systems; organization runs its floor | Lease clauses, landlord security summary, annual walk-through, fire certificate copy | | Colocation suite | Provider runs building, power, cooling, fire, perimeter and reception; organization runs cage, racks and its access list | Assessment with DOC-ISMS-079 (`isms/data-centre-colocation-assessment`), provider certificates and reports, monthly access list reconciliation | | Public cloud | Provider runs all physical controls of its data centres | Provider ISO/IEC 27001 certificate and independent reports reviewed under DOC-ISMS-044 and the supplier assessment (`compliance/supplier-security-assessment`) | Record inherited controls in the SoA (DOC-ISMS-011) as applicable, with the provider's evidence as the reference. ## 12. Size tiers | Topic | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group | |---|---|---|---| | Sites | One leased office plus remote staff; production on one public cloud provider in two regions | Two offices and one colocation suite | 6 sites in 4 countries: HQ, 3 plants, 1 service centre, 1 data centre | | Zones used | Z0 to Z3 (network cabinet room is Z3); no Z4 on site | Z0 to Z4 (colocation cage is Z4) | Z0 to Z4 at every site; OT control rooms are Z4 | | Entry control | Landlord badge for the building, own badge for the floor, key register for the cabinet room | Badge system across both offices; colocation provider biometric plus own cage lock | Group badge platform, turnstiles at HQ and plants, guards at plants and the data centre | | Monitoring (A.7.4) | Landlord CCTV at the lobby, own door alarm on the cabinet room, badge log reviewed monthly by the ISMS manager | Own CCTV at office entrances, provider CCTV in the colocation hall, weekly Z4 log review by the security team | Central security operations reviewing alarms across sites, CCTV at all perimeters, guard patrols | | Environmental | Landlord fire systems; small UPS for the network cabinet | UPS in both offices; colocation power, cooling and fire covered by provider assessment | Generators, redundant cooling and gas suppression at the data centre; site flood and heat assessments per plant | | Third-party assurance | Cloud provider certificate and reports reviewed annually | Colocation assessment annually with a site visit, cloud reports annually | Data centre self-assessment plus assessments of any colocation used by country units | | Policy owner | ISMS manager (0.5 FTE) with the office manager | Facilities lead with the 3-person security team | Group physical security manager in the CISO's security office, site managers per site | ## 13. Control mapping | Control | Short label | Section | Primary records | |---|---|---|---| | A.7.1 | Physical security perimeters | 5.1 | Floor plans, perimeter inspection | | A.7.2 | Physical entry controls | 5.2, 5.3 | Badge issue and revocation records, visitor log, access reviews | | A.7.3 | Securing offices, rooms and facilities | 6.1 | Site walk checklist | | A.7.4 | Physical security monitoring (new in 2022) | 7 | Alarm log, badge log reviews, CCTV retention record | | A.7.5 | Protection against physical and environmental threats | 8 | Site threat assessment, fire drill records | | A.7.6 | Working in secure areas | 6.2 | Zone access list, secure area inspection | | A.7.7 | Clear desk and clear screen | 10, DOC-ISMS-056 | Clear desk check results | | A.7.8 | Equipment siting and protection | 9.1 | Rack and room inspection | | A.7.9 | Assets used off-premises | 10, DOC-ISMS-058 | Asset inventory, encryption compliance report | | A.7.10 | Storage media | 10 | Media register, courier records | | A.7.11 | Supporting utilities | 9.2 | UPS, generator and cooling test records | | A.7.12 | Cabling security | 9.3 | Cable plans, change records | | A.7.13 | Equipment maintenance | 9.4 | Maintenance log | | A.7.14 | Secure disposal or re-use of equipment | 10, DOC-ISMS-057 | Disposal and reuse log, certificates | ## 14. Exceptions, compliance and review - Exceptions are requested with the security exception request (`security/security-exception-request`, DOC-ISMS-122) and approved at the authority the risk methodology (DOC-ISMS-010 section 2.4) sets for the residual risk: the risk owner for Low; the risk owner and department head for Medium (top management if the risk category is Averse, DOC-ISMS-015 section 9 rule 1); top management with a treatment decision for High, recorded in the risk acceptance record (DOC-ISMS-019). Critical residual risk is not approvable as an exception: treat it or stop the activity. Maximum duration is 12 months for Low or Medium and 6 months for High; at expiry the exception is reassessed, and a renewal is a new decision (DOC-ISMS-122 section 7). - Compliance is checked by an annual physical security walk-through per site using section 13 as the checklist, by the access reviews in section 5.2 and by internal audit (DOC-ISMS-082). - Breaches of this policy are handled through the disciplinary process for security breaches (DOC-ISMS-052). - The policy owner reviews this policy at least annually and after a new site, a significant physical incident, a change of landlord or provider, or a change in the risk assessment. ## 15. Records and evidence | Record | Owner | Location | Retention | Proves | |---|---|---|---|---| | Site register and floor plans | Policy owner | [Document system] | Current plus superseded versions [3 years] | A.7.1, A.7.3 scope | | Badge issue and revocation records | HR and site manager | [Badge system] | [Employment plus 1 year] | A.7.2 | | Quarterly Z3 and Z4 access reviews | Zone owner | [Ticket system] | [3 years] | A.7.2, A.7.6 | | Visitor log | Reception | [Visitor system] | [90 days] unless needed for an incident | A.7.2 | | Alarm and door event log | Security operations | [Alarm system] | [12 months] | A.7.4 | | CCTV footage and access to it | Security operations | [Recorder] | [30 days]; extracts held with the incident record | A.7.4 | | Site threat and environmental assessments | Policy owner | [Risk register] | [3 years] | A.7.5 | | UPS, generator, cooling and fire test records | IT operations and facilities | [Maintenance system] | [3 years] | A.7.11, A.7.13 | | Disposal and reuse log, certificates | IT operations | DOC-ISMS-057 | [Per retention schedule] | A.7.14 | | Provider assessments and reports | Supplier owner | DOC-ISMS-079 | [Contract plus 3 years] | Section 11 | Map these records in the control evidence matrix (DOC-ISMS-033, `isms/control-evidence-matrix`) and list them in the documented information register (DOC-ISMS-028). ## 16. References | Reference | Edition | Use | |---|---|---| | ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 published 2024-02-23 | Annex A theme A.7; clause 4.1 climate change determination. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html | | ISO/IEC 27002:2022 | 2022 | Guidance for A.7 controls. https://www.iso.org/standard/75652.html | | ISO/IEC 27040:2024 | 2024 | Storage security, including sanitisation. https://www.iso.org/standard/80194.html | | NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization | September 2025 | Sanitisation programme and methods (see DOC-ISMS-057) | Related templates: `compliance/information-security-policy`, `compliance/ms-scope`, `compliance/asset-inventory`, `compliance/risk-register`, `compliance/statement-of-applicability`, `compliance/business-impact-analysis`, `ops/onboarding-checklist`, `ops/access-review`, `ops/change-request`, `isms/clear-desk-clear-screen-policy`, `isms/equipment-disposal-reuse-record`, `isms/data-centre-colocation-assessment`, `isms/remote-working-policy`, `isms/endpoint-device-byod-policy`, `isms/control-evidence-matrix`. ## Standard and licence note Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A theme A.7 and the guidance in ISO/IEC 27002:2022. Only control numbers and short descriptive labels are used; the rules, zone model, tables and examples are original wording, and no ISO/IEC text is reproduced. You need the official standards to apply the controls: ISO/IEC 27001 at https://www.iso.org/standard/82875.html and ISO/IEC 27002 at https://www.iso.org/standard/75652.html. Check the current edition and amendments before use. Quillmere names are fictional. Template licence: MIT.