ISO 27001 Annex A 7.3: securing offices, rooms and facilities

An enterprise buyer tours your office during due diligence. Through the meeting-room glass they can read a client screen, and the lobby directory names your comms cupboard. Nobody has broken in, and the deal still wobbles.

This guide covers ISO 27001 Annex A 7.3, Securing offices, rooms and facilities, for information security managers and operations leads at UK firms of 25–250 staff in leased space. It shows how to zone the floor, fix sightlines, deal with landlords, stay proportionate and pass the auditor's walkthrough.

What does ISO 27001 Annex A 7.3 cover that A.7.1 and A.7.2 do not?

Annex A 7.3 governs the design of the rooms themselves. A.7.1 draws the security boundaries and A.7.2 controls the entry doors; A.7.3 asks whether the spaces behind them were laid out securely, siting sensitive work away from public reach so the workspace protects information passively, all day, without anyone remembering to act.

The quickest way to separate the three physical controls is to ask which question each one answers:

• A.7.1: where does our protected area begin and end?
• A.7.2: who may cross that line, and how do we know?
• A.7.3: once someone is inside, what can they see, hear, reach or infer?

For a firm of 25–250 people, the failure is rarely a break-in. It is everyday exposure nobody designed against, and a single overheard or photographed piece of client information can cost a regulated firm a contract and a notification obligation. Auditors read sloppy room hygiene as a signal about the wider management system.

The control is preventive: the protection comes from layout and construction, which stop exposure arising rather than detecting it afterwards. It supports confidentiality most directly. Integrity and availability benefit too, since a room an intruder can reach is a room where equipment can be tampered with or taken.

The NPSA protective security methodology frames physical protection as five principles: deter, detect, delay, mitigate and respond. Layout does the deterring and delaying quietly, and it costs almost nothing at fit-out. Retrofitting it later is expensive.

What are the ISO 27001 Annex A securing offices requirements for zoning?

Zone the office once, on paper, into three tiers: public (reception and client meeting rooms), staff-only (the main floor) and restricted (server or comms room, records storage). Lock each zone in proportion to what it holds. Most offices need exactly one genuinely restricted room, sited in the interior of the floor plan.

Write down what each tier means in practice, so the zoning survives staff changes:

• Public: visitors are expected, so nothing sensitive is visible or audible. Escort rules begin at the door to the next tier.
• Staff-only: the main floor. Entry is controlled at the suite door, and visitors are supervised while they are inside.
• Restricted: a lock of its own, a short named access list and an entry log. This is where regulated data concentrates.

Keep the restricted room away from a public corridor and from ground-floor windows. A room on the edge of the building can be watched, reached or heard from outside the zone meant to contain it.

Treat the zoning as a one-to-two-day design exercise plus whatever locksmithing follows. Do it early, alongside the A.7.1 boundary work, because the entry rules of A.7.2 and the environmental safeguards of A.7.5 both attach to the zones you define here.

Then check that the boundary is real. The NIST SP 800-12 handbook chapter on physical and environmental security points out that an intruder may be able to go over the top of a partition that stops at the underside of a suspended ceiling.

A partition wall that stops at the ceiling tiles is a suggestion, not a boundary.

Test it from inside the room. Push up a ceiling tile and look: if the wall ends at the tile line, extend it to the structural slab or fit a barrier in the void. Voids beneath raised floors and shared service risers defeat a locked door in exactly the same way.

How do you manage sightlines, acoustics and signage in an office?

Manage sightlines and acoustics where they matter: fit privacy film or reposition desks where screens face glass, and hold client calls and HR discussions in enclosed rooms rather than open plan beside visitor seating. Keep the outside boring: no server room plaque, no lobby floor plan, no directory naming where records live.

The ICO guidance on physical security controls advises positioning screens to prevent unauthorised visibility and obstructing public-facing windows. These fixes are cheap and high-yield:

• Glazing: privacy film on windows and glass walls that face the street, the corridor or a neighbouring tenant.
• Desk layout: turn monitors to face walls, or move the people handling client data away from glass.
• Reception: keep screens, post trays and printouts out of the visitor's line of sight.
• Acoustics: keep sensitive rooms away from thin partitions and shared corridors. A door gap or ceiling void carries voices as easily as it lets people through.

To find what needs fixing, sit where a visitor sits for ten minutes. Note what you can read, what you can hear and what the room tells you about where the valuable things are. An auditor will do the same walk without asking a single question.

Signage is the opposite problem, because discretion matters more than convenience at the edge of your suite. Internal wayfinding for staff is fine; what to avoid is anything that tells an outsider which door is worth forcing. Give restricted rooms neutral room numbers, and keep any floor plan that shows them inside the staff-only zone.

Check what the shared building publishes about your floor as well as what you display yourself. Visitor management helps here: a visitor who is met, signed in and escorted never needs to read the walls to find their way.

How do you secure offices in leased or serviced buildings?

Treat your suite as the perimeter you own. The landlord controls the building shell; you control everything inside your demise, starting with your own lock on your own restricted room. Assume cleaners and building staff hold master keys, and keep evidence of the landlord's arrangements for the audit file.

The lease defines the line. Read it for three things: who holds keys to the shell, what out-of-hours access the landlord and its contractors have, and whether you may fit your own lock inside the demise. If the landlord needs emergency access, agree a sealed-key arrangement that leaves a trace when opened.

Hold these items in the audit file for a leased or serviced suite:

• The lease clauses, or a landlord statement, on building access, out-of-hours entry and key holding.
• The managing agent's confirmation of how cleaners and contractors are engaged and when they attend.
• Your key and fob register for the suite and for the restricted room.
• A risk-assessment note recording the residual risk from landlord master keys, and why you accept it.

Cleaners are the usual anxiety, and the answer is design rather than distrust. Keep records storage and comms equipment behind a lock the landlord's keys do not open, and have cleaning happen with the restricted room closed. A self-closing, self-latching door means the lock no longer depends on whoever leaves last.

Protection that depends on someone remembering to lock up is a habit, not a control.

One caution carried over from fire safety: a restricted-room lock must never trap anyone or block an escape route. Where a secured door sits on an exit path, it needs a release that works from the inside without a key or fob, so check the design with whoever owns your fire risk assessment before the locksmith arrives.

In a serviced office or co-working space, the rule applies at smaller scale. Rent the lockable room or cage if the provider offers one and own its key register. Ask how the provider's reception handles visitors, because their procedure becomes part of your evidence.

How much physical security is proportionate for a mid-market office?

Proportionate means matched to a UK mid-market services firm's threat profile: zoning, sensible locks, controlled entry to one restricted room, and basic fire and water protection. Electromagnetic shielding, mantraps and sound-masking suit a different threat profile. A risk assessment concluding 'not proportionate' is a perfectly good audit answer.

Fix the baseline first, then argue upwards only where risk demands it. The defensible baseline we recommend for a 50-person regulated firm has four parts:

• Zoning on paper, with the three tiers and the reasoning behind them.
• Sensible locks on the restricted room and on any cabinets holding physical records.
• Controlled, logged entry to the one restricted room. A fob, keypad or signed key log is enough at this scale.
• Basic fire and water protection in that room, since A.7.5 tests it from the environmental angle.

Biometrics and gas suppression are justified by risk, not by the standard. When your assessment rejects them, record the threat profile you assessed, the options you considered and who signed off, because the record of that reasoning is the evidence.

The pattern to watch is the 40-person office that prices biometric readers and acoustic masking while the comms cupboard has no lock. Over-engineering feels like diligence. Spend the first pound on the gap an auditor can walk into.

What evidence will an auditor ask for, and how is Annex A 7.3 graded?

Auditors want zoning on paper that matches the floor they walk: the Statement of Applicability entry, a marked-up floor plan, restricted-room access lists and entry logs, and visitor records. They sample the access list against current staff, trace a recent leaver, then walk the floor. Grading turns on whether the control exists and operates.

The Statement of Applicability is your register of applicable controls. Assemble this evidence set before the audit:

• Policy and SoA: the A.7.3 entry and your physical and environmental security policy, both describing the zones.
• Floor plan: marked up with the public, staff-only and restricted tiers.
• Access records: the restricted-room access list and entry logs.
• Visitor records: sign-in entries showing supervision inside non-public areas.
• Review records: access recertification, walk-round inspections, and maintenance of any fire or leak protection in the restricted room.

The review records show the control operating rather than merely existing. Even so, the strongest evidence is the walkthrough itself: the auditor tries the restricted door and looks at what is visible from reception.

Expect questions like these in the room:

• "Which areas of this office are restricted, and what decided that?"
• "Who can get into the server room, and when was that list last checked?"
• "What can a visitor sitting in reception see and hear?"
• "Do your partition walls go to the slab, or stop at the ceiling tiles?"
• "How quickly does a leaver lose access to the restricted areas?"

Beyond the access list and the leaver trace, expect a couple of visitor-log entries to be traced back to the hosts who signed them in wherever visitor supervision applies. An entry with no named host is the gap that sample finds.

In certification-body practice, a sensitive room with no meaningful control at all, in a firm whose risk profile clearly demands one, is the absence-of-requirement case and grades major. An unlocked restricted room, or an access list carrying accumulated leavers, grades minor. Repeated minors of the same kind can aggregate to a major as a pattern.

Two things sink otherwise good evidence. One is the propped door on the restricted room, noticed on the walk before any document is opened. The other is draft or mismatched versions of the physical security documentation, where the paper describes a floor that no longer exists.

How can you automate access reconciliation and floor walks for A.7.3?

Physical layout does not automate, but its operation can. Reconcile restricted-room access lists against the HR roster on a schedule, route door events and held-open alarms into your existing alerting, and run quarterly walk-rounds as a ticketed checklist so findings and fixes accumulate as evidence without manual chasing.

Build it in three steps:

1. Reconcile access. Export the fob or key-holder list on a schedule and compare it with the HR roster. Ticket every difference and close it with a dated revocation.
2. Alert on door events. Send held-open alarms and out-of-hours entries from the access system into the same channel as your other logs.
3. Ticket the walk-round. Create a recurring quarterly checklist covering propped doors, the ceiling-line check, sightlines from reception, signage and the key register.

Each closed ticket is a dated artefact. After a few quarters, the audit file assembles itself.

An access list nobody has reconciled is a record of who used to work here.

Scale the system to the office. With one restricted room and a handful of fobs, a calendar reminder and a two-line log may be the entire engineered system. At that size the cadence satisfies both auditors and enterprise customers, and it costs minutes a quarter.

Frequently asked questions