Physical Security Policy Template (ISO/IEC 27001 A.7)

Physical Security Policy: [Organization name]

Topic-specific policy that sets the physical and environmental security rules for every site, room, piece of equipment and storage medium inside the ISMS scope. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A theme A.7 (physical controls A.7.1 to A.7.14), with implementation guidance in ISO/IEC 27002:2022. Clear desk rules (A.7.7) and disposal records (A.7.14) have their own documents and are summarised here. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and applicability
2. Policy principles
3. Roles and responsibilities
4. Site register and security zones
5. Perimeters, entry controls and visitors (A.7.1, A.7.2)
6. Secure offices, rooms and working in secure areas (A.7.3, A.7.6)
7. Physical security monitoring (A.7.4)
8. Physical and environmental threats (A.7.5)
9. Equipment siting, utilities, cabling and maintenance (A.7.8, A.7.11, A.7.12, A.7.13)
10. Off-premises assets, storage media, disposal and clear desk (A.7.7, A.7.9, A.7.10, A.7.14)
11. Facilities run by third parties
12. Size tiers
13. Control mapping
14. Exceptions, compliance and review
15. Records and evidence
16. References

1. Purpose, scope and applicability

This policy sets the rules that keep people who have no business need out of the places where [Organization name] holds information and equipment, and that protect those places and that equipment against fire, water, power loss, theft and tampering. It covers:

• every site listed in the site register (section 4.1), including shared offices, plants, warehouses and colocation suites;
• equipment owned or leased by the organization wherever it is used, including laptops, phones, removable media and network equipment;
• printed information and other non-electronic media;
• all employees, contractors, temporary staff, visitors, cleaners, maintenance engineers and suppliers who enter a site or handle equipment in scope.

Data centres operated by cloud providers are covered through supplier assurance (A.5.19 to A.5.23) rather than through direct physical rules: section 11 explains how. Out of scope: [list any site or area excluded from the ISMS scope, with the reason recorded in DOC-ISMS-002].

2. Policy principles

1. Defence in depth. Information and equipment are protected by layered zones. The more sensitive the asset, the more layers a person crosses to reach it.
2. Least physical access. Access to each zone is granted on a business need, approved by the zone owner and removed when the need ends.
3. Every entry is attributable. Entry to restricted and secure zones is logged to a person, not to a shared badge or code.
4. Visitors are escorted. Anyone without an access right is signed in, identified, badged and escorted in restricted zones.
5. Risk-based protection. Environmental and utility protection is sized to the risk assessment (DOC-ISMS-010), including climate related hazards identified under clause 4.1.
6. Equipment is tracked through its life. Every asset that holds information is in the asset inventory (DOC-ISMS-012) from receipt to verified sanitisation or destruction.
7. Assurance where we do not operate. Where a landlord, colocation provider or cloud provider runs the facility, the organization obtains and reviews evidence that the provider's controls work.

3. Roles and responsibilities

4. Site register and security zones

4.1 Site register

4.2 Zone model

Each move to a higher zone needs a separate access decision. Do not let a Z2 badge open a Z3 door by default.

5. Perimeters, entry controls and visitors (A.7.1, A.7.2)

5.1 Perimeters (A.7.1)

• Define the perimeter of each site and each zone on a floor plan kept with the site register.
• External doors, ground-floor windows and roof access are secured, alarmed out of hours or both. Fire exits cannot be opened from the outside and raise a local or monitored alarm when opened.
• Delivery and loading areas are separated from Z2 and higher zones, so deliveries do not give access to the office.
• In shared buildings, record in section 11 which perimeter controls the landlord provides and how you check them.

5.2 Entry controls (A.7.2)

• Personal badges are issued only after HR confirms the start date and the onboarding checklist (ops/onboarding-checklist) is complete.
• Badges show no organization name or site address on the outside.
• Access rights follow the zone model. Z3 and Z4 rights are requested through a ticket, approved by the zone owner and reviewed each quarter (ops/access-review).
• Leavers' badges are disabled on the last working day, ideally by an automated feed from HR, and collected with other assets (A.5.11). Lost badges are reported and disabled the same day.
• Anti-tailgating: personnel do not hold doors to Z3 or Z4 for others. Where tailgating is a recorded risk, install turnstiles, mantraps or door-held alarms.
• Shared PIN codes and mechanical keys are a last resort. Where used, keep a key register, change codes at least [every 6 months] and after any leaver who knew them.

5.3 Visitors

• Visitors sign in at reception with name, organization, host, time in and time out. Electronic visitor systems must protect visitor personal data and keep it only for [90 days] unless an incident requires longer.
• Visitors wear a visible visitor badge and are escorted in Z2. In Z3 and Z4 an authorised person escorts them at all times and the visit is logged in the zone log.
• Visitors sign or accept the site rules (and a confidentiality agreement, DOC-ISMS-051, where they may see confidential information).
• Maintenance engineers and cleaners with regular access are treated as personnel with a limited badge, screened according to DOC-ISMS-050 where the risk requires.
• Uncollected visitor badges at the end of the day are disabled and followed up with the host.

6. Secure offices, rooms and working in secure areas (A.7.3, A.7.6)

6.1 Securing offices, rooms and facilities (A.7.3)

• Sensitive rooms carry no sign that shows their purpose. Internal directories and floor plans that show Z3 and Z4 rooms are classified Internal or higher.
• Rooms where confidential discussions take place are not overlooked from outside. Use blinds or window film where screens or whiteboards face a public area.
• Z3 and Z4 rooms stay locked when not occupied. Keys and access cards for these rooms are held by named custodians.
• Printers that handle confidential output use pull printing or sit in a Z3 print room.

6.2 Working in secure areas (A.7.6)

• Only work that needs the secure area takes place there. No lone working in Z4 without a check-in arrangement where safety requires.
• No food, drink, combustible packaging or personal storage in server rooms and OT control rooms.
• Photography and video recording in Z4 require the zone owner's approval. Personal recording devices are restricted where [classification or contract] requires it.
• Unattended secure areas are locked and checked. Empty secure areas are inspected [monthly] for unused equipment and stored material.
• Third-party engineers in Z4 are escorted unless they hold an approved unescorted right recorded in the access list.

7. Physical security monitoring (A.7.4)

Watching the sites matters because locks and badges only work if someone notices when they fail, and visible monitoring also puts people off trying. It combines the following sources, chosen per zone in section 4.2:

Rules:

• Monitoring systems are protected against tampering and their clocks are synchronised with the organization's time source (A.8.17) so that badge, CCTV and system logs can be correlated.
• CCTV is placed and signed in line with applicable privacy law (for example GDPR in the EU) and does not cover private areas such as washrooms. A privacy assessment (compliance/dpia) is done before a new CCTV system is installed where the law requires.
• Physical security alerts that may affect information are reported through DOC-ISMS-023 and handled under DOC-ISMS-020.
• Monitoring results feed the measurement programme: alarms per month, door-held events, unreviewed access lists and time to revoke leaver badges.

8. Physical and environmental threats (A.7.5)

• Assess physical and environmental threats for each site when it is added and at least every [2 years], recording risks in the risk register (DOC-ISMS-016). Consider location (flood plains, coastal storm exposure, seismic zones, wildfire areas), building type, neighbours and the history of incidents.
• Where the context review (DOC-ISMS-003) finds climate change to be a relevant issue, include rising flood, heat and storm risks and how they affect cooling, power and staff access.
• Fire: detection in all zones; suppression in Z4 suitable for electrical equipment; extinguishers checked as local fire rules require; fire drills with the result recorded.
• Water: no water pipes above Z4 equipment where avoidable; leak detection under raised floors and near cooling units; equipment kept off the floor in flood-prone areas.
• Heat and humidity: environmental monitoring with alert thresholds in Z4 (section 9.2).
• Deliberate attack and unrest: entry controls (section 5), glazing and lighting proportionate to the site risk.
• Business continuity: site loss scenarios are part of the business impact analysis (compliance/business-impact-analysis) and ICT readiness plan (DOC-ISMS-047).

9. Equipment siting, utilities, cabling and maintenance (A.7.8, A.7.11, A.7.12, A.7.13)

9.1 Equipment siting and protection (A.7.8)

• Servers, network devices and OT controllers sit in Z3 or Z4 in locked racks or cabinets.
• Screens that show confidential information are placed so they cannot be read from public areas or through windows.
• Equipment is kept away from water, heat sources, direct sunlight and heavy foot traffic.

9.2 Supporting utilities (A.7.11)

9.3 Cabling security (A.7.12)

• Power and data cabling between zones runs in conduits, trunking or ceiling spaces that are not accessible from Z0 or Z1.
• Patch panels and network cabinets are locked and labelled with codes that do not reveal their purpose to an outsider.
• Unused network ports in Z1 and meeting rooms are disabled or placed on a guest network (DOC-ISMS-063).
• Cabling changes are made through change management (ops/change-request) and cable plans are kept current.

9.4 Equipment maintenance (A.7.13)

• Maintain equipment according to the supplier's recommended intervals and record each service in a maintenance log.
• Only authorised engineers perform maintenance. Remote maintenance sessions are approved and logged.
• Before equipment leaves the site for repair, remove or sanitise storage media, or use a supplier contract that covers confidentiality and on-site media retention.
• After maintenance, check that the equipment works and that no unauthorised changes were made.

10. Off-premises assets, storage media, disposal and clear desk (A.7.7, A.7.9, A.7.10, A.7.14)

• Clear desk and clear screen (A.7.7): rules, checks and metrics are in DOC-ISMS-056 (isms/clear-desk-clear-screen-policy).
• Assets used off-premises (A.7.9): laptops and phones are encrypted and managed (DOC-ISMS-058); equipment is never left unattended in vehicles or public places; equipment taken to high-risk destinations follows the travel rules in DOC-ISMS-054. Equipment that stays off-premises permanently (home office equipment) is listed in the asset inventory with its location type.
• Storage media (A.7.10): removable media is allowed only where [business need, approved list]; confidential information on removable media is encrypted; media is labelled according to DOC-ISMS-042 and stored in a locked Z3 cabinet or safe; media in transit uses approved couriers with tracking.
• Secure disposal or reuse (A.7.14): before reuse or disposal, storage is sanitised or destroyed and the result recorded in DOC-ISMS-057 (isms/equipment-disposal-reuse-record), following data/data-retention-deletion-standard for retention decisions.

11. Facilities run by third parties

Record inherited controls in the SoA (DOC-ISMS-011) as applicable, with the provider's evidence as the reference.

12. Size tiers

13. Control mapping

14. Exceptions, compliance and review

• Exceptions are requested with the security exception request (security/security-exception-request, DOC-ISMS-122) and approved at the authority the risk methodology (DOC-ISMS-010 section 2.4) sets for the residual risk: the risk owner for Low; the risk owner and department head for Medium (top management if the risk category is Averse, DOC-ISMS-015 section 9 rule 1); top management with a treatment decision for High, recorded in the risk acceptance record (DOC-ISMS-019). Critical residual risk is not approvable as an exception: treat it or stop the activity. Maximum duration is 12 months for Low or Medium and 6 months for High; at expiry the exception is reassessed, and a renewal is a new decision (DOC-ISMS-122 section 7).
• Compliance is checked by an annual physical security walk-through per site using section 13 as the checklist, by the access reviews in section 5.2 and by internal audit (DOC-ISMS-082).
• Breaches of this policy are handled through the disciplinary process for security breaches (DOC-ISMS-052).
• The policy owner reviews this policy at least annually and after a new site, a significant physical incident, a change of landlord or provider, or a change in the risk assessment.

15. Records and evidence

Map these records in the control evidence matrix (DOC-ISMS-033, isms/control-evidence-matrix) and list them in the documented information register (DOC-ISMS-028).

16. References

Related templates: compliance/information-security-policy, compliance/ms-scope, compliance/asset-inventory, compliance/risk-register, compliance/statement-of-applicability, compliance/business-impact-analysis, ops/onboarding-checklist, ops/access-review, ops/change-request, isms/clear-desk-clear-screen-policy, isms/equipment-disposal-reuse-record, isms/data-centre-colocation-assessment, isms/remote-working-policy, isms/endpoint-device-byod-policy, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A theme A.7 and the guidance in ISO/IEC 27002:2022. Only control numbers and short descriptive labels are used; the rules, zone model, tables and examples are original wording, and no ISO/IEC text is reproduced. You need the official standards to apply the controls: ISO/IEC 27001 at https://www.iso.org/standard/82875.html and ISO/IEC 27002 at https://www.iso.org/standard/75652.html. Check the current edition and amendments before use. Quillmere names are fictional. Template licence: MIT.