ISO 27001 Annex A 7.1: physical security perimeters for SMEs

The due-diligence questionnaire asks what stands between client data and the street. Your honest answer is an office door and a landlord. This guide to ISO 27001 Annex A 7.1 shows UK firms of 25–250 people how to turn that answer into zones, solid boundaries and evidence a Stage 2 auditor accepts, without commissioning building works.

It covers ceiling voids, fire exits, serviced offices, home working and the walk-round itself. It is written for the security, IT and compliance leads who own physical security alongside everything else.

What is ISO 27001 Annex A 7.1 and what counts as a physical security perimeter?

ISO 27001 Annex A 7.1 is the zoning control. You decide which spaces hold information worth protecting, draw a boundary around each, and make that boundary solid enough for what sits inside. A perimeter can be one lockable office or a layered site with a hardened server room at its core, but it cannot have soft spots.

The control is preventive. A sound perimeter stops an intruder before they reach anything, instead of detecting or repairing the damage afterwards. Confidentiality, integrity and availability all apply, because a person standing inside the wrong boundary can read, tamper with or remove whatever it encloses.

Soft spots undo the whole line. A wall that stops at a suspended ceiling, an unbarred ground-floor window or a fire escape that opens from outside defeats a boundary that looks solid on a drawing.

Boundaries scale to the firm. At this size they usually look like one of these:

• A lockable office door for a small team sharing one floor.
• A locked comms cupboard or records store inside an open-plan suite.
• A layered site: building shell, then your suite, then a hardened server room.

Annex A 7.1 only draws the lines. A.7.2 governs who crosses them, and A.7.4 watches for anyone who crosses uninvited.

Does being 100% in the cloud exempt you from Annex A 7.1?

No. Cloud hosting changes where servers sit, not what your office holds: the comms cupboard, network kit, paper records, laptops left overnight and the floor itself. Each of those still needs a boundary sized to what it holds, and the Stage 2 auditor checks that boundary in person, whatever your hosting model.

Certification bodies walk the floor at Stage 2, the main assessment. A comms cupboard that does not lock, or a server room wall that can be climbed over via the ceiling void, is a visible, photographable finding, and no cloud contract answers it.

The commercial exposure runs wider than the audit:

• Enterprise due-diligence questionnaires ask where client data physically lives.
• Cyber insurers price physical exposure into premiums.
• A break-in that takes a NAS or a filing cabinet holding personal data can become a breach-notification exercise under UK GDPR.

Your cloud provider's data centre is a separate question. NCSC Cloud Security Principle 2 on asset protection and data centre security asks you to be confident that the provider's physical security protects against unauthorised access, tampering, theft or reconfiguration of systems. That duty covers the provider's buildings and does not replace the duties in your own.

Zoning is also the cheapest physical control to get right. It is mostly decisions and documentation, not construction.

How do you structure layered physical defence: shell, suite and high-security zones?

Start with a short site risk assessment listing where information assets sit, then give each location a boundary matched to its sensitivity. Layers tighten inward: building shell, your suite, then the few rooms justifying extra protection. Most firms end up with two or three zones, not ten.

Four steps take you from nothing to a defensible zoning scheme:

1. Run the site risk assessment. List where information assets actually sit: server or comms room, records storage, the open floor itself. Sensitivity drives strength, so the kitchen does not need what the comms cupboard needs.
2. Match a boundary to each location. A lockable door may be enough for the open floor. A records store or server room needs more.
3. Layer inward. Move from shell to suite to the small number of rooms that justify extra protection. Each layer should be harder to pass than the one outside it.
4. Write the zones down. Put them in a section of the physical security policy or, at the smaller end, directly in the Statement of Applicability (SoA), your register of which Annex A controls apply and how. Add a marked-up floor plan.

The layering logic comes from perimeter practice. NPSA guidance on perimeter protective security principles sets out perimeter measures built on the principles of deter, detect and delay, with mitigation and response behind them. For an office, that translates to a visible lock, an alarm on the openings and walls that take time to defeat.

A typical 50-person regulated firm lands on three zones: the landlord-run building shell, its own suite, and a locked comms room and records store inside the suite. Nothing about that needs a building project.

Expect a few days of effort: the assessment, the floor plan and the policy section, plus whatever remediation the walls genuinely need. Do this before the rest of the physical family, because A.7.2 and A.7.4 both assume the zones already exist.

What do auditors check in the perimeter fabric: walls, ceiling voids and windows?

Auditors check that every boundary around a sensitive room is as strong as its weakest surface. That means walls running full height to the structural slab, solid doors with decent locks, and protection on reachable windows. A partition stopping at the suspended ceiling is a step-ladder bypass that a ceiling-tile lift exposes in seconds.

Walk each sensitive boundary and check it in this order:

• Walls. Full height to the structural slab around anything sensitive, not just to the false ceiling.
• Doors. Solid doors with decent locks that are actually kept locked.
• Windows. Protection on ground-floor and otherwise reachable windows.
• Ceiling void. Lift a tile above the wall and look for a clear route across.

Proportionality applies. Ordinary office space can keep standard partitions. Full-height construction is for high-security rooms such as the server room and records store, so a typical firm is carrying up one or two walls, not rebuilding the floor.

A partition that stops at the ceiling grid fails twice: as a barrier and as fire separation.

If the wall belongs to the landlord, raise the request in writing and treat the risk while you wait; the FAQ below sets out the options.

How do you secure fire exits and other openings without breaching life-safety rules?

Fire exits must stay openable from inside, so they are secured with alarms and monitoring rather than locks. Roof hatches, delivery bays and ventilation routes need the same sweep. Life safety always wins: a lockout that breaches fire and emergency-egress regulation creates a finding in two rule books at once.

Fire doors are the one opening you cannot simply lock, so the control comes from detection. An alarm sounds when the door opens, and monitoring means somebody notices. The auditor's question is whether you would know if one was opened.

The ICO Physical Security Toolkit under the Data Protection Audit Framework expects entry points to combine perimeter security with electronic controls. Use that as the design brief for each opening, and leave the electronic configuration to your access-control work.

Four failures turn up repeatedly on this boundary:

• Fire exits propped open during the working day.
• Roof hatches and ventilation routes that nobody monitors.
• Delivery bays outside the mental map of "the office door".
• Hardening that breaches egress law, turning one finding into a legal exposure.

How do you manage the perimeter in a serviced office or co-working space?

You control your suite, your comms cupboard and anything lockable inside them; the operator controls the shell and lobby. Record that split in writing and hold evidence of the landlord's security arrangements. Saying the building has security, without paper behind it, does not satisfy an auditor.

Write a one-page split between you and the operator, and keep it with the floor plan:

• Operator: the shell, the lobby, building-level security and anything shared.
• You: your suite, the comms cupboard and every lockable room or cabinet inside it.
• Evidence: the operator's written security arrangements, such as a description of reception, out-of-hours access and alarms, held on file.

In a co-working space your perimeter may shrink to a locked room or cabinet. That is acceptable, provided the boundary matches the sensitivity of what sits inside it.

If the operator will not put its arrangements in writing, record that gap in the risk register and lean on the boundaries you do control, such as a locked comms cupboard or a secure cabinet.

What does Annex A 7.1 expect for remote and home-working environments?

A proportionate version of the same idea. For home workers, a lockable room or storage cabinet plus sensible screen habits, such as angling screens away from housemates, satisfies the intent. The standard does not expect domestic fortification, so nobody expects home CCTV or structural changes to a spare bedroom.

The test is whether another person in the household could read or take company information. A lockable room or cabinet answers the risk of taking, and screen placement answers the risk of reading. Write both expectations into your remote working guidance so they are checkable rather than assumed.

Most of the home-working ground sits elsewhere in Annex A: A.6.7 sets the remote working rules and A.7.9 protects equipment taken off-site. A.7.1 contributes the principle of a boundary sized to what it protects, which is why a cabinet can be enough. Skip home surveys: a spare-room audit programme would cost more than the risk it addresses.

What evidence does ISO 27001 Annex A 7.1 need beyond a policy?

Auditors want the zoning on paper and the building to agree with it: a policy or Statement of Applicability section defining the perimeters, the site risk assessment behind them, and a floor plan showing the zones. Operational proof sits on top: alarm test records, lock and door maintenance logs and walk-round reports.

Collect these artefacts and keep them together:

• Zoning definition: the policy or SoA section naming each perimeter and the rooms inside it.
• Site risk assessment: the reasoning that justified each boundary, dated, so a later change has a baseline to be judged against.
• Marked-up floor plan: the strongest single artefact, because the auditor holds it while walking the floor and expects to find it accurate.
• Operational proof: alarm test records, door, lock and sensor maintenance logs, and walk-round reports, with each fault shown as closed.
• Landlord arrangements: in a shared building, the operator's security arrangements.

A perimeter built once and never checked is a drawing, not a control.

The commonest evidence gap is drift. A new server rack lands in an ordinary cupboard, nobody updates the policy, and no risk assessment explains the change. The floor plan is where that drift shows first, so date every revision and keep the superseded versions.

This control is largely structural, so there is little to automate here. The automatable surface, alarm testing, log review and access reconciliation, belongs to A.7.2 and A.7.4. Your effort in this control goes into keeping the plan and the records current.

What do Stage 2 auditors sample on the walk-round, and how do you stay ready?

The walk-round is the audit. Expect the auditor to lift a ceiling tile at the server room, push on the fire escape, check ground-floor windows and compare your floor plan against reality, then pull alarm test records. Sensitive assets with no boundary at all grade major; bypassable partitions or unalarmed fire doors grade minor.

Expect these questions in the room:

• "Show me your zones. Which rooms hold sensitive assets, and what is the boundary around each?"
• "Does this server room wall go all the way up past the ceiling tiles?"
• "How are your fire exits secured, and would you know if one was opened?"
• "Who looks after the delivery entrance and the roof hatch, and when were the locks last checked?"
• "How did you satisfy yourself these boundaries match the sensitivity of what is inside them?"

Grading follows certification-body practice. Undocumented zoning also grades minor. Several minors against the same control read as a pattern, and a pattern aggregates to major.

Most findings come from maintenance rather than design: overdue lock checks, unmaintained logbooks, alarm call-out lists naming people who have left, and boundary doors left unlocked during the day. That is why a perimeter that passed its last audit can fail the next one without a single wall moving.

A boundary is only as strong as its laziest hour.

A light operational rhythm keeps you ready:

• Walk the boundaries periodically, checking that doors, locks and alarms still work.
• Log faults and fix them, keeping the record.
• Revisit the zoning on any office move or new floor space.
• Design so you can tighten temporarily in a heightened-threat period without rebuilding.

At this scale, that rhythm gives the auditor records to pull instead of recollections to test.

Frequently asked questions