Physical security perimeters

What the control asks

The organization is to define security perimeters and use them around areas holding information and other associated assets. Purpose: keep unauthorized people out and prevent physical harm to or tampering with the organization's information and assets. Guidance: where appropriate, define each perimeter and decide its location and strength according to the security requirements of the assets inside; make the perimeter of a building or site containing processing facilities physically sound, with no gaps or easy break-in points, solid exterior roofs, walls, ceilings and floors, external doors protected by bars, alarms, locks or similar, doors and windows locked when unattended, added outside protection considered for windows, above all on the ground floor, and ventilation openings taken into account; and alarm, monitor and test every fire door in a perimeter together with the walls so the required resistance is achieved to suitable standards, with the doors failing safe. Other information: protection comes from one or more barriers around the premises and facilities; a secure area might be one lockable office or a group of rooms inside a continuous internal barrier; extra internal barriers may separate areas with different requirements; and measures should be capable of being strengthened when threat levels rise.

Purpose in the standard’s terms, in our words: Keeps unauthorized people out and protects information and assets from physical harm or tampering.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Site plans showing defined security perimeters and their strength relative to the assets inside
• Physical security surveys or assessments of walls, roofs, floors, doors, windows and vents
• Records of external door protection such as locks, bars and alarms
• Alarm, monitoring and test records for perimeter fire doors, including fail-safe operation
• Procedures for locking doors and windows when areas are unattended
• Plans for strengthening physical measures during heightened threat

Where audits commonly find gaps

• False ceilings or raised floors let people bypass walls around secure rooms
• Fire doors on the perimeter are propped open or not alarmed
• Ground-floor windows and ventilation ducts are unprotected
• Perimeters are not reassessed after building alterations

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (11.1.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 7.10 Storage media
• 7.13 Equipment maintenance
• 7.2 Physical entry

Read the five attributes All 93 controls