ISO 27001 Annex A 7.2: physical entry controls that survive audit

The enterprise questionnaire asks who can physically reach the systems and papers holding its data. Your team rents one floor of a serviced building, so the honest answer is "the landlord, mostly", and that answer earns a nonconformity under ISO 27001 Annex A 7.2 at Stage 2. This guide sets out what the control requires, what auditors sample and how a lean UK firm runs entry control without turnstiles or a facilities team.

What do ISO 27001 Annex A 7.2 physical entry controls require?

ISO 27001 Annex A 7.2 requires that nobody reaches a building, secure room or delivery bay holding your information assets without being authorised, identifiable and accounted for. Staff use managed credentials, visitors are identity-checked and supervised, and goods arrive through a controlled receiving point. The 2022 control merges 2013's A.11.1.2 and A.11.1.6.

Annex A 7.1 draws the lines around your secure areas. This control governs every crossing of those lines. It is a preventive control: its job is to stop the wrong person reaching the asset rather than to investigate afterwards, and it touches confidentiality, integrity and availability alike. Someone through the wrong door can read, alter or simply walk off with what they find.

Three groups cross those lines, and each needs a different answer:

• Staff pass through managed credentials: a fob, code or key issued for a reason and recorded.
• Visitors are identity-checked on arrival and supervised inside anything beyond reception.
• Goods enter through a controlled receiving point, kept apart from the spaces where information is processed.

Because the two older controls are now one, an auditor reading ISO 27001 7.2 expects a single coherent story that covers the parcel as well as the person. For a 50-person firm, that story fits in a short section of the physical security policy or the Statement of Applicability (the SoA, your register of which Annex A controls apply and how).

How does A.7.2 mirror logical access rights for fobs, keys and codes?

A.7.2 is the physical twin of logical access control. Entry rights are granted for a reason, reviewed periodically and withdrawn the moment they are no longer justified, exactly as Annex A 5.18 expects for accounts. Badge PINs, door codes and physical keys are handled like credentials under A.5.17, including re-keying when holders leave.

The lifecycle has the same three beats as any account, and each maps cleanly to a door:

• Grant: a named approver signs off every addition, tied to a secure area from your A.7.1 zoning.
• Review: one person owns a periodic comparison of the door system's user list against current staff.
• Revoke: the offboarding checklist kills door access the same day it kills the Google account.

Movers matter as much as leavers. Someone who changes team keeps the old team's door access unless the process removes it, and that is how a finance fob ends up in a sales pocket.

A door fob that outlives its owner is an orphaned admin account with a lanyard.

Credentials that are not electronic need the same rigour. Keep a register of physical keys and shared door codes showing who holds what, and rotate codes when someone who knew them leaves. NIST SP 800-53 Rev. 5 Control PE-3 takes the same line, expecting keys and combinations to be changed when the people holding them are transferred or terminated.

Strength should scale to the zone. Badge-plus-PIN or a second factor belongs on a server room or records store, not the kitchen. Build the system so you can tighten checks for an elevated-threat period without rebuilding it.

Who is responsible for physical entry in a serviced office or shared building?

You are accountable for your own suite even when a landlord runs the building. The operator controls the shell: lobby, lifts, building CCTV. You control your suite door, comms cupboard and anything sensitive inside. Auditors accept landlord-run controls for the shell, provided you hold evidence of those arrangements.

Most lean firms run a serviced floor, a landlord-controlled building and a largely remote team, so treating entry as the landlord's problem is tempting. Auditors do not accept it, and assuming otherwise is one of the quickest routes to a Stage 2 nonconformity.

Hold three pieces of evidence for the landlord side:

• The operator's written access arrangements, including how building passes are issued and revoked.
• Confirmation of who can enter your suite out of hours, such as cleaners or building staff with master keys.
• Any assurance the operator offers about the building, such as a certification or an independent audit statement.

Master keys are the quiet gap. If the operator's staff can open your door, that belongs in your risk picture, and a lock or an event log on the comms cupboard compensates.

Suppliers that host your data raise the same question at one remove. When your data sits in a third-party facility or data centre, you cannot inspect the doors yourself, so you rely on the provider's certifications and independent audit assertions. NCSC Cloud Security Principle 2: Asset protection and resilience frames the test: you should be confident the provider's physical security protects against unauthorised access, tampering, theft or reconfiguration of systems.

Done this way, a serviced office is an advantage. The shell is professionally staffed, and your effort goes into the one door and cupboard you truly own.

How should you manage visitors, and what do CCTV and visitor logs mean under UK GDPR?

Run every visitor through one consistent routine: confirm who they are, log arrival and departure, badge them visibly and keep them hosted beyond reception. A tablet app or a well-kept book both pass; no record at all fails. CCTV and digital logs need a UK GDPR lawful basis, signage and restricted access.

A routine that works at the front desk of a 50-person firm runs in this order:

1. Confirm identity against the booking or a photo ID, and note the host.
2. Log arrival with time, name, company and host.
3. Badge visibly with a distinct visitor badge, so staff can spot an unbadged stranger.
4. Host continuously beyond reception: the host collects the visitor and walks them out.
5. Log departure and collect the badge.

Hosting is the step that slips, because it feels awkward. Make it the named host's job rather than reception's, and an unescorted visitor becomes a visible exception instead of a habit.

A visitor log nobody reads until the audit isn't a control. It's a diary.

Pick five entries a month and ask each host whether they remember the visit. That ten-minute habit turns the register into evidence that the control operates.

CCTV and digital logs under UK GDPR

CCTV footage and digital visitor logs are personal data. You need a lawful basis for each, signage telling people cameras are running and a defined retention period. The ICO Checklist for limited CCTV systems sets the storage test: images are held securely for a defined period, and only a limited number of authorised people can access them.

A sign-in app deserves the same treatment as the cameras. Decide who in the firm can search the entries, choose a retention period you can justify, and say so in your privacy notice. Retention should cover the audit period you may be sampled on, without keeping visitor data indefinitely.

How do you handle deliveries without exposing the workspace?

Give every delivery a defined landing spot at reception or a receiving area, log what arrives, and check packaging for signs of interference before it moves inward. Couriers should never wander to a desk or a server cupboard. Separating goods from workspaces is the part of A.7.2 inherited from the 2013 delivery and loading control.

Packaging checks take seconds and need no equipment:

• Is the seal intact, and does the label match an expected order?
• Is the parcel addressed to a named person rather than just the company?
• Does the box show signs of having been opened and resealed?

Hardware deserves one extra step. Laptops and other devices go straight to IT, where they are logged against the asset register before anyone uses them.

In a serviced building, the operator may run the mail room or loading bay. Ask how parcels are handed to tenants and who signs for them, then keep that answer with your landlord evidence. The auditor's question is simple: where do couriers leave packages, and who checks them?

What do auditors test, and how are physical entry lapses graded?

Auditors sample recent leavers against the door system's active credentials, trace visitor log entries to named hosts, and walk the premises looking for propped doors and unchallenged strangers. No entry control around sensitive areas grades major; a live leaver fob or log gap grades minor, aggregating to major when the lifecycle is not operating.

Expect questions like these in the room:

• "Who can open this office, and how do you know that list is current?"
• "This person left in June. Show me when their fob stopped working."
• "Walk me through what happens when I arrive as a visitor."
• "Where do couriers leave parcels, and who checks them?"
• "How would you know if that fire exit had been propped open all afternoon?"

The walk-around is the test you cannot rehearse on paper. Auditors notice propped doors, missing badges and an unchallenged stranger, sometimes themselves, faster than any document review. If mechanical locks guard anything sensitive, expect the key and code register to be pulled as well.

The leaver cross-check is one of the most commonly sampled gaps at Stage 2, the main certification assessment. It is the piece auditors test hardest and the cheapest to wire, which is why it comes first in the automation sequence below.

Grading follows certification-body practice:

• Major: no entry control at all around areas holding sensitive assets, which is the absence of the requirement itself.
• Minor: a single sampled leaver with a live fob, or a gap in the visitor log.
• Minor aggregating to major: a pattern of such lapses, which shows the access lifecycle is not operating.

What are the six physical entry traps that fail audits?

Six traps recur: propped fire exits, door-system user lists nobody reconciles, visitors roaming unescorted, mechanical locks with unnamed key holders, alarm contact lists naming people who left, and over-engineering with turnstiles and biometrics when nobody signs visitors in. Each has a cheap fix that sits in the practices above.

Pair each trap with its fix and you can self-check before the auditor walks the floor:

• Propped fire exits: fire doors must stay usable in an emergency, so alert on door-held-open events and do a weekly walk-round instead of locking them.
• Unreconciled user lists: contractors and temporary staff are the usual residue, because they often leave without an HR offboarding ticket. Issue their fobs with an expiry date.
• Unescorted visitors: the named-host rule in the visitor routine closes this, and the monthly five-entry check proves it.
• Anonymous mechanical keys: a lock that logs nothing leaves the register as your only record, so count the keys in hand against it at each access review.
• Stale alarm contacts: review the call-out list whenever the leaver checklist runs.
• Over-engineering: fix the sign-in routine before buying hardware.

None of the fixes needs a budget line. They need an owner, a calendar entry and a record that the check happened.

What audit evidence does ISO 27001 Annex A physical entry need?

Auditors expect the paper and the system to agree: documented entry rules, a current door-system export with its event log, visitor records showing guest, time and host, and de-provisioning records proving leavers lost access on time. Access review records with anomalies found and actioned carry more weight than a clean-looking list.

Keep this evidence set ready:

• Entry rules: the policy or SoA section, approved and matching what reception does.
• Door-system export and event log: the current user list plus entries and denials.
• Visitor registers: guest, time in and out, and host.
• De-provisioning records: closed offboarding tickets, timestamped against leave dates.
• Key and code register: who holds each mechanical key or shared code, and when codes were last rotated.
• Landlord arrangements: the operator's access rules for the building shell.
• Awareness material: badge-wearing and challenging unescorted strangers, where your risk profile justifies it.

A review record that reads "two contractors still active, removed the same day, ticket attached" proves the control works. A spotless list suggests nobody looked.

How can you automate physical entry from HR event to audit evidence?

Wire four things: an HR leaver event that raises a badge-deactivation ticket, door-system logs pulled into your existing log aggregation, a scheduled diff of door-system users against the HR roster, and visitor sign-in software. The quarterly access review becomes a five-minute exception check, and the evidence appears as a by-product.

Build in this order, because the first step carries most of the audit value:

1. Revocation hook. A leaver event in the HR system raises the deactivation ticket automatically. The closed ticket, timestamped against the leave date, is the evidence, with no hunting.
2. Reconciliation job. Schedule the door-system diff and route exceptions to a named owner.
3. Door logs as data. Ship the event log to wherever you already aggregate logs. Alert on out-of-hours entry to sensitive rooms, door-held-open events and denied-access streaks.
4. Visitor software. A sign-in app produces the register, host attribution and badge lifecycle as reception works normally.

With these four in place, the ongoing rhythm is a quarterly access review plus periodic log checks. At that cadence, a 50-person firm satisfies both its auditor and the enterprise customers asking who can reach their data.

Our GRC engineering service builds this chain: HR-triggered badge revocation, door-system log ingestion and scheduled reconciliation. The table shows how each trigger becomes evidence.

Frequently asked questions