ISO 27001 Physical Controls

• 7.1 Physical Security Perimeters

  "Security perimeters shall be defined and used to protect areas that contain information and other associated assets."[1]

• 7.2 Physical Entry

  "Secure areas shall be protected by appropriate entry controls and access points."[1]

• 7.3 Securing Offices, Rooms and Facilities

  "Physical security for offices, rooms and facilities shall be designed and implemented."[1]

• 7.4 Physical Security Monitoring

  "Premises shall be continuously monitored for unauthorized physical access."[1]

• 7.5 Protecting Against Physical and Environmental Threats

  "Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented."[1]

• 7.6 Working in Secure Areas

  "Security measures for working in secure areas shall be designed and implemented."[1]

• 7.7 Clear Desk and Clear Screen

  "Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced."[1]

• 7.8 Equipment Siting and Protection

  "Equipment shall be sited securely and protected."[1]

• 7.9 Security of Assets Off-Premises

  "Off-site assets shall be protected."[1]

• 7.10 Storage Media

  "Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements."[1]

• 7.11 Supporting Utilities

  "Information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities."[1]

• 7.12 Cabling Security

  "Cables carrying power, data or supporting information services shall be protected from interception, interference or damage."[1]

• 7.13 Equipment Maintenance

  "Equipment shall be maintained correctly to ensure availability, integrity and confidentiality of information."[1]

• 7.14 Secure Disposal or Re-use of Equipment

  "Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use."[1]

Need help putting this into practice? See our ISO 27001 compliance services or read our ISO 27001 articles.