Physical entry

What the control asks

Secure areas are to be protected by suitable entry controls and access points. Purpose: allow physical access to information and assets only to those authorized. General guidance: entry points like loading bays and goods-in, and anywhere unauthorized people could get in, are controlled and where possible kept apart from processing facilities. Consider: restricting sites and buildings to authorized people, with physical access rights provided, reviewed, updated and revoked (5.18); recording every entry in a protected paper log or electronic trail that is watched, and safeguarding those logs (5.33) and sensitive authentication information; a process and technical means to govern entry to rooms that hold or process information, using cards, biometrics or two-factor methods such as card plus PIN, and double doors for sensitive areas; a staffed reception or other means of controlling entry; inspecting personal belongings on entry and exit where local law permits; visible identification for everyone, prompt reporting of unescorted or unbadged people, and distinguishable badges for staff, suppliers and visitors; supplier access to secure areas only when needed, authorized and monitored; extra attention in buildings shared with other organizations; measures that can be stepped up when physical risk rises; protecting secondary entrances like fire exits against misuse; and a key management process for physical keys and lock codes or combinations, with a logbook or yearly key audit and controlled access (5.17). Visitors: authenticate their identity, record arrival and departure times, admit them only for specific authorized purposes with briefings on the area's security rules and emergency procedures, and keep them supervised unless expressly exempted. Goods-in areas: restrict outside access to identified, authorized people; design areas so delivery staff cannot reach the rest of the building; secure external doors while inner doors are open; inspect incoming items for explosives, chemicals or other hazards before moving them; register deliveries under asset management (5.9, 7.10); separate incoming and outgoing goods where possible; and check for tampering in transit, reporting any at once to security.

Purpose in the standard’s terms, in our words: Allows physical access to information and assets only to authorized people.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Identity and access management; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Physical access rights records with provisioning, periodic review and revocation evidence
• Electronic access control logs or physical logbooks, protected and monitored
• Access control system configuration for secure areas, such as card plus PIN or biometrics and double doors
• Visitor logs recording identity checks, arrival and departure, purpose and escort
• Key management records including key registers and annual key audits
• Delivery area procedures and records of inspection, registration and tamper checks on incoming items

Where audits commonly find gaps

• Access badges of leavers remain active
• Visitors move around unescorted and without visible badges
• Emergency exits can be opened from outside or are not alarmed
• Delivery staff can walk from the loading bay into office areas

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.1.2, 11.1.6) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.37 Documented operating procedures
• 7.1 Physical security perimeters
• 7.10 Storage media

Read the five attributes All 93 controls