All 93 controls · Physical controls
Control 7.6
Working in secure areas
What ISO/IEC 27002:2022 control 7.6 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Security measures for working inside secure areas are to be designed and put in place. Purpose: stop the people who work in secure areas from damaging or tampering with the information and assets held there. Guidance: the measures apply to all personnel and to every activity in the secure area. Consider telling people that a secure area exists, or what happens in it, only when they need to know; avoiding unsupervised work there, for safety and to reduce the opportunity for malicious acts; locking vacant secure areas and inspecting them periodically; banning photographic, video, audio and other recording equipment, including cameras on user devices, unless authorized; controlling how user endpoint devices are brought in and used; and displaying emergency procedures where they can be seen or easily reached.
Purpose in the standard’s terms, in our words: Stops people working in secure areas from damaging or tampering with what is kept there.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Documented rules for working in secure areas that apply to all personnel and activities
- Records showing that knowledge of secure areas is limited to people who need it
- Supervision or two-person rules and records for work in secure areas
- Inspection records for vacant secure areas and evidence they are locked
- A policy and signage prohibiting unauthorized recording devices, with authorization records for exceptions
- Visible or readily accessible emergency procedures in each secure area
Where audits commonly find gaps
- Staff routinely take phones with cameras into secure areas without authorization
- Work in data rooms is done alone out of hours with no supervision
- Vacant secure rooms are left unlocked
- Floor plans and descriptions of secure areas circulate widely
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (11.1.5) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.