---
title: "ISO 27001 Annex A 7.2: physical entry controls that survive audit"
canonical: https://www.grcmana.io/vault/iso-27001/annex-a-7-2-physical-entry
published: 2023-05-05
updated: 2026-10-07
author: "Harry West"
framework: "ISO 27001"
control: "A.7.2 Physical entry"
journeyStage: implementation
---

# ISO 27001 Annex A 7.2: physical entry controls that survive audit

## Key takeaways

Annex A 7.2 asks that everyone crossing into a secure area, whether staff, visitor or courier, is authorised, identifiable and accounted for. Treat entry rights like logical access rights and wire revocation to your HR leaver event. A lean UK firm passes audit with a consistent visitor routine, reconciled door lists and landlord evidence, not turnstiles.

- **Scope** — Annex A 7.2 covers every crossing of a secure-area boundary: staff with managed credentials, visitors with identity checks and supervision, and deliveries through a controlled receiving point.
- **Lifecycle** — Entry rights follow the logical access lifecycle: granted for a reason, reviewed periodically and revoked promptly, with a register of keys and codes and re-keying when holders leave.
- **Audit grading** — Auditors cross-check leavers against live door credentials and walk the premises. No entry control around sensitive areas grades major; a live leaver fob or visitor-log gap grades minor.
- **Responsibility** — A landlord can run the building shell, but you remain accountable for your suite door, comms cupboard and sensitive rooms, and should hold evidence of the landlord's access arrangements.

The enterprise questionnaire asks who can physically reach the systems and papers holding its data. Your team rents one floor of a serviced building, so the honest answer is "the landlord, mostly", and that answer earns a nonconformity under ISO 27001 Annex A 7.2 at Stage 2. This guide sets out what the control requires, what auditors sample and how a lean UK firm runs entry control without turnstiles or a facilities team.

## What do ISO 27001 Annex A 7.2 physical entry controls require?

ISO 27001 Annex A 7.2 requires that nobody reaches a building, secure room or delivery bay holding your information assets without being authorised, identifiable and accounted for. Staff use managed credentials, visitors are identity-checked and supervised, and goods arrive through a controlled receiving point. The 2022 control merges 2013's A.11.1.2 and A.11.1.6.

Annex A 7.1 draws the lines around your secure areas. This control governs every crossing of those lines. It is a preventive control: its job is to stop the wrong person reaching the asset rather than to investigate afterwards, and it touches confidentiality, integrity and availability alike. Someone through the wrong door can read, alter or simply walk off with what they find.

Three groups cross those lines, and each needs a different answer:

- **Staff** pass through managed credentials: a fob, code or key issued for a reason and recorded.
- **Visitors** are identity-checked on arrival and supervised inside anything beyond reception.
- **Goods** enter through a controlled receiving point, kept apart from the spaces where information is processed.

Because the two older controls are now one, an auditor reading ISO 27001 7.2 expects a single coherent story that covers the parcel as well as the person. For a 50-person firm, that story fits in a short section of the physical security policy or the Statement of Applicability (the SoA, your register of which Annex A controls apply and how).

## How does A.7.2 mirror logical access rights for fobs, keys and codes?

A.7.2 is the physical twin of logical access control. Entry rights are granted for a reason, reviewed periodically and withdrawn the moment they are no longer justified, exactly as Annex A 5.18 expects for accounts. Badge PINs, door codes and physical keys are handled like credentials under A.5.17, including re-keying when holders leave.

The lifecycle has the same three beats as any account, and each maps cleanly to a door:

- **Grant:** a named approver signs off every addition, tied to a secure area from your A.7.1 zoning.
- **Review:** one person owns a periodic comparison of the door system's user list against current staff.
- **Revoke:** the offboarding checklist kills door access the same day it kills the Google account.

Movers matter as much as leavers. Someone who changes team keeps the old team's door access unless the process removes it, and that is how a finance fob ends up in a sales pocket.

A door fob that outlives its owner is an orphaned admin account with a lanyard.

Credentials that are not electronic need the same rigour. Keep a register of physical keys and shared door codes showing who holds what, and rotate codes when someone who knew them leaves. [NIST SP 800-53 Rev. 5 Control PE-3](https://csf.tools/reference/nist-sp-800-53/r5/pe/pe-3/) takes the same line, expecting keys and combinations to be changed when the people holding them are transferred or terminated.

Strength should scale to the zone. Badge-plus-PIN or a second factor belongs on a server room or records store, not the kitchen. Build the system so you can tighten checks for an elevated-threat period without rebuilding it.

## Who is responsible for physical entry in a serviced office or shared building?

You are accountable for your own suite even when a landlord runs the building. The operator controls the shell: lobby, lifts, building CCTV. You control your suite door, comms cupboard and anything sensitive inside. Auditors accept landlord-run controls for the shell, provided you hold evidence of those arrangements.

Most lean firms run a serviced floor, a landlord-controlled building and a largely remote team, so treating entry as the landlord's problem is tempting. Auditors do not accept it, and assuming otherwise is one of the quickest routes to a Stage 2 nonconformity.

Hold three pieces of evidence for the landlord side:

- The operator's written access arrangements, including how building passes are issued and revoked.
- Confirmation of who can enter your suite out of hours, such as cleaners or building staff with master keys.
- Any assurance the operator offers about the building, such as a certification or an independent audit statement.

Master keys are the quiet gap. If the operator's staff can open your door, that belongs in your risk picture, and a lock or an event log on the comms cupboard compensates.

Suppliers that host your data raise the same question at one remove. When your data sits in a third-party facility or data centre, you cannot inspect the doors yourself, so you rely on the provider's certifications and independent audit assertions. [NCSC Cloud Security Principle 2: Asset protection and resilience](https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles/principle-2-asset-protection-and-resilience) frames the test: you should be confident the provider's physical security protects against unauthorised access, tampering, theft or reconfiguration of systems.

Done this way, a serviced office is an advantage. The shell is professionally staffed, and your effort goes into the one door and cupboard you truly own.

## How should you manage visitors, and what do CCTV and visitor logs mean under UK GDPR?

Run every visitor through one consistent routine: confirm who they are, log arrival and departure, badge them visibly and keep them hosted beyond reception. A tablet app or a well-kept book both pass; no record at all fails. CCTV and digital logs need a UK GDPR lawful basis, signage and restricted access.

A routine that works at the front desk of a 50-person firm runs in this order:

1. **Confirm identity** against the booking or a photo ID, and note the host.
2. **Log arrival** with time, name, company and host.
3. **Badge visibly** with a distinct visitor badge, so staff can spot an unbadged stranger.
4. **Host continuously** beyond reception: the host collects the visitor and walks them out.
5. **Log departure** and collect the badge.

Hosting is the step that slips, because it feels awkward. Make it the named host's job rather than reception's, and an unescorted visitor becomes a visible exception instead of a habit.

A visitor log nobody reads until the audit isn't a control. It's a diary.

Pick five entries a month and ask each host whether they remember the visit. That ten-minute habit turns the register into evidence that the control operates.

### CCTV and digital logs under UK GDPR

CCTV footage and digital visitor logs are personal data. You need a lawful basis for each, signage telling people cameras are running and a defined retention period. The [ICO Checklist for limited CCTV systems](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/checklist-for-limited-cctv-systems/) sets the storage test: images are held securely for a defined period, and only a limited number of authorised people can access them.

A sign-in app deserves the same treatment as the cameras. Decide who in the firm can search the entries, choose a retention period you can justify, and say so in your privacy notice. Retention should cover the audit period you may be sampled on, without keeping visitor data indefinitely.

## How do you handle deliveries without exposing the workspace?

Give every delivery a defined landing spot at reception or a receiving area, log what arrives, and check packaging for signs of interference before it moves inward. Couriers should never wander to a desk or a server cupboard. Separating goods from workspaces is the part of A.7.2 inherited from the 2013 delivery and loading control.

Packaging checks take seconds and need no equipment:

- Is the seal intact, and does the label match an expected order?
- Is the parcel addressed to a named person rather than just the company?
- Does the box show signs of having been opened and resealed?

Hardware deserves one extra step. Laptops and other devices go straight to IT, where they are logged against the asset register before anyone uses them.

In a serviced building, the operator may run the mail room or loading bay. Ask how parcels are handed to tenants and who signs for them, then keep that answer with your landlord evidence. The auditor's question is simple: where do couriers leave packages, and who checks them?

## What do auditors test, and how are physical entry lapses graded?

Auditors sample recent leavers against the door system's active credentials, trace visitor log entries to named hosts, and walk the premises looking for propped doors and unchallenged strangers. No entry control around sensitive areas grades major; a live leaver fob or log gap grades minor, aggregating to major when the lifecycle is not operating.

Expect questions like these in the room:

- "Who can open this office, and how do you know that list is current?"
- "This person left in June. Show me when their fob stopped working."
- "Walk me through what happens when I arrive as a visitor."
- "Where do couriers leave parcels, and who checks them?"
- "How would you know if that fire exit had been propped open all afternoon?"

The walk-around is the test you cannot rehearse on paper. Auditors notice propped doors, missing badges and an unchallenged stranger, sometimes themselves, faster than any document review. If mechanical locks guard anything sensitive, expect the key and code register to be pulled as well.

The leaver cross-check is one of the most commonly sampled gaps at Stage 2, the main certification assessment. It is the piece auditors test hardest and the cheapest to wire, which is why it comes first in the automation sequence below.

Grading follows certification-body practice:

- **Major:** no entry control at all around areas holding sensitive assets, which is the absence of the requirement itself.
- **Minor:** a single sampled leaver with a live fob, or a gap in the visitor log.
- **Minor aggregating to major:** a pattern of such lapses, which shows the access lifecycle is not operating.

## What are the six physical entry traps that fail audits?

Six traps recur: propped fire exits, door-system user lists nobody reconciles, visitors roaming unescorted, mechanical locks with unnamed key holders, alarm contact lists naming people who left, and over-engineering with turnstiles and biometrics when nobody signs visitors in. Each has a cheap fix that sits in the practices above.

Pair each trap with its fix and you can self-check before the auditor walks the floor:

- **Propped fire exits:** fire doors must stay usable in an emergency, so alert on door-held-open events and do a weekly walk-round instead of locking them.
- **Unreconciled user lists:** contractors and temporary staff are the usual residue, because they often leave without an HR offboarding ticket. Issue their fobs with an expiry date.
- **Unescorted visitors:** the named-host rule in the visitor routine closes this, and the monthly five-entry check proves it.
- **Anonymous mechanical keys:** a lock that logs nothing leaves the register as your only record, so count the keys in hand against it at each access review.
- **Stale alarm contacts:** review the call-out list whenever the leaver checklist runs.
- **Over-engineering:** fix the sign-in routine before buying hardware.

None of the fixes needs a budget line. They need an owner, a calendar entry and a record that the check happened.

## What audit evidence does ISO 27001 Annex A physical entry need?

Auditors expect the paper and the system to agree: documented entry rules, a current door-system export with its event log, visitor records showing guest, time and host, and de-provisioning records proving leavers lost access on time. Access review records with anomalies found and actioned carry more weight than a clean-looking list.

Keep this evidence set ready:

- **Entry rules:** the policy or SoA section, approved and matching what reception does.
- **Door-system export and event log:** the current user list plus entries and denials.
- **Visitor registers:** guest, time in and out, and host.
- **De-provisioning records:** closed offboarding tickets, timestamped against leave dates.
- **Key and code register:** who holds each mechanical key or shared code, and when codes were last rotated.
- **Landlord arrangements:** the operator's access rules for the building shell.
- **Awareness material:** badge-wearing and challenging unescorted strangers, where your risk profile justifies it.

A review record that reads "two contractors still active, removed the same day, ticket attached" proves the control works. A spotless list suggests nobody looked.

## How can you automate physical entry from HR event to audit evidence?

Wire four things: an HR leaver event that raises a badge-deactivation ticket, door-system logs pulled into your existing log aggregation, a scheduled diff of door-system users against the HR roster, and visitor sign-in software. The quarterly access review becomes a five-minute exception check, and the evidence appears as a by-product.

Build in this order, because the first step carries most of the audit value:

1. **Revocation hook.** A leaver event in the HR system raises the deactivation ticket automatically. The closed ticket, timestamped against the leave date, is the evidence, with no hunting.
2. **Reconciliation job.** Schedule the door-system diff and route exceptions to a named owner.
3. **Door logs as data.** Ship the event log to wherever you already aggregate logs. Alert on out-of-hours entry to sensitive rooms, door-held-open events and denied-access streaks.
4. **Visitor software.** A sign-in app produces the register, host attribution and badge lifecycle as reception works normally.

With these four in place, the ongoing rhythm is a quarterly access review plus periodic log checks. At that cadence, a 50-person firm satisfies both its auditor and the enterprise customers asking who can reach their data.

Our GRC engineering service builds this chain: HR-triggered badge revocation, door-system log ingestion and scheduled reconciliation. The table shows how each trigger becomes evidence.

| Trigger | Automated action | Evidence produced |
| --- | --- | --- |
| Leaver recorded in HR system | Badge-deactivation ticket raised | Closed ticket timestamped against leave date |
| Quarterly schedule | Door-system users diffed against HR roster | Exception list with owner and resolution |
| Door held open or out-of-hours entry | Alert from aggregated door logs | Alert record and follow-up note |
| Visitor arrives | Sign-in app records guest, host and badge | Register with arrival and departure times |

## Frequently asked questions

### What should happen when someone forgets their badge or door fob under Annex A 7.2?

A known colleague or manager confirms the person's identity before a temporary credential is issued, and the event is recorded. Make the temporary badge expire at close of day and collect it on exit. Frequent forgotten badges are worth reviewing, because ad-hoc tailgating past reception is what the auditor writes up.

### Does Annex A 7.2 require a dedicated physical security policy for a 50-person firm?

Not necessarily. A short section in a broader security policy, or the control's entry in the SoA, is enough if it names each secure area, who may enter it, how they authenticate and who approves new access, plus how visitors and deliveries are handled. It must be approved and match what reception does, because a mismatch between document and practice is the usual finding.

### Does Annex A 7.2 still apply to a remote-first firm with no office of its own?

Usually, because the control follows your information assets rather than your headcount. A co-working space where equipment stays overnight, a storage unit holding paper records or a comms cabinet at a shared site all need entry rules. Home working falls under A.6.7 remote working instead. If no premises hold your assets at all, record that reasoning in the SoA.

### How long does it take to set up A.7.2 physical entry controls from scratch?

Expect a few days of setup once your A.7.1 zoning exists. If you have no zoning yet, define the zones first, because every entry rule hangs off them. Hardware rarely sets the pace: most of the effort goes into writing the entry rules, building the key register and agreeing the host routine with reception.