All 93 controls · Physical controls
Control 7.3
Securing offices, rooms and facilities
What ISO/IEC 27002:2022 control 7.3 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
The organization is to design and implement physical protection for its offices, rooms and facilities. Purpose: keep intruders out of these spaces and protect the information and assets in them from harm or tampering. Guidance: consider locating critical facilities where the public cannot reach them; where relevant, keeping buildings unobtrusive with minimal indication of their purpose and no obvious signs inside or out that information processing takes place; arranging facilities so confidential information and activities cannot be seen or heard from outside, and considering electromagnetic shielding where appropriate; and keeping directories, internal phone lists and online maps that show where confidential processing facilities are located out of the hands of unauthorized people.
Purpose in the standard’s terms, in our words: Keeps intruders out of offices, rooms and facilities and protects what they contain.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Asset management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Facility security design documentation showing critical facilities sited away from public access
- Photographs or survey records confirming the absence of signage revealing processing facilities
- Assessments of visual and acoustic leakage from meeting rooms and processing areas, with mitigations such as window film or sound insulation
- Electromagnetic shielding assessments where relevant
- Controls restricting access to directories, floor plans and online maps showing sensitive facility locations
Where audits commonly find gaps
- Data rooms are labelled or signposted for convenience
- Screens and whiteboards in sensitive rooms are visible from the street
- Internal maps showing server room locations are published on the intranet or public sites
- Critical equipment is placed in areas the public can reach
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.1.3) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.