ISO 27001 Annex A 7.6: one-page rules for working in secure areas

The auditor is standing in your server room and asks who stays with the engineer fixing the air-con. Your badge logs are spotless, and nobody has an answer. ISO 27001 Annex A 7.6 is the control behind that question, and this guide shows UK firms of 25–250 people how to meet it with one page of working rules.

You will get the escort line, a phone rule that holds, empty-room checks, fire-safe locks and the evidence auditors sample. It is written for the security, IT and compliance leads who own the room and the audit.

What does ISO 27001 Annex A 7.6 require inside a secure area?

ISO 27001 Annex A 7.6 requires working rules that govern conduct inside secure areas, after entry controls have done their job. It limits knowledge of the area to those who need it, avoids unsupervised lone work, locks and checks empty rooms, controls recording devices, and keeps emergency procedures visible to anyone inside.

Entry controls decide who gets through the door; this control decides what happens next. It presumes the zoning from Annex A 7.1 and works alongside Annex A 7.7 on what is left visible in the room. Its job is to close the gap between being authorised to enter and being trusted to act alone and unobserved.

A secure room with flawless badge logs and no conduct rules is a well-guarded place to work unobserved.

Most firms of this size have one or two genuinely secure areas, usually a server or comms room and perhaps a records store. The perimeter gets the attention while the inside runs on trust.

The control exists for scenarios that are mundane and expensive:

• A contractor left alone in the comms room for an afternoon.
• A phone photo of a whiteboard that ends up somewhere it shouldn't.
• A room left unlocked and unchecked for a month before anyone notices something missing.

For a regulated firm, each one becomes a breach-notification question with no good answer, because "who was in there and what did they do" has no record.

Annex A 7.6 is a preventive control that protects confidentiality, integrity and availability together. It covers what can be seen or photographed, unsupervised tampering, and damage to the equipment the area exists to protect.

What counts as a secure area, and how long should the working rules be?

A secure area is whatever your Annex A 7.1 zoning designates as one, typically the server or comms room and anywhere regulated records concentrate. For a 25–250 person firm, the working rules fit on one page inside the physical security policy, not a standalone manual.

Designation comes first. If you have zoned nothing as secure, the control has nothing to attach to, and an auditor will ask why.

Name the room on the page. "The second-floor comms room" gives an auditor something to walk to; "secure areas" gives them a definition to argue with. If your estate is mostly cloud and the only secure area is a cupboard of network kit, the page gets shorter, not absent.

Write one page per zone, which in practice means one page in total. It covers:

• Who may enter and work in the area.
• The two-person expectation for non-routine work.
• Escort requirements for anyone unvetted.
• The camera and recording position.
• Locking when the room is vacated.
• Where emergency instructions live.

Fold the page into the physical security policy. Nobody at this scale needs a standalone document, and a separate manual is one more thing that drifts out of date.

Keep knowledge of the area on a need-to-know footing as well. Don't advertise what is in the room, or what happens there, beyond the people whose job requires it.

Over-engineering is the pitfall to avoid. Sign-in ceremonies and phone amnesties for a room that a handful of vetted engineers enter weekly add friction and no assurance. Proportionate rules that people follow beat impressive ones they don't.

When should work in a secure area be supervised or escorted?

Routine work by vetted sysadmins can be done alone; the rule targets unobserved one-person situations for sensitive or irreversible work, and for anyone unvetted. Contractors, cleaners and engineers get a vetted escort by default, and their visit lands in the visitor or works record. Write the line into your rules.

Lone working is a safety matter before it is a security one. The Health and Safety Executive guidance on protecting lone workers says employers should provide training, supervision, monitoring and support for lone workers, so a sysadmin alone in a server room already sits inside a duty of care. Annex A 7.6 adds the security question: who would notice if something went wrong, or went missing?

NIST SP 800-53 Revision 5 Control PE-3 gives you a recognised reference for the escort side. It calls for visitors to be escorted and their activity controlled in organisation-defined circumstances, and your rules are where you define those circumstances.

A workable line for your rules:

• Solo is fine for routine work by vetted staff, such as checking indicators or applying scheduled patches.
• Two people for sensitive or irreversible work, such as decommissioning hardware or disposing of media.
• Escort always for anyone unvetted, whatever the task, which covers most contractors, cleaners and engineers: a vetted staff member stays with them for the whole visit.

The works record needs little: the date, the visitor, the task and the escort's name. That is enough for an auditor to trace a work order to a person who was present.

The usual failure is the cleaner or air-con engineer working unescorted because escorting feels like an imposition on a busy team. If out-of-hours cleaning access is the current reality, change it for the secure room specifically; the rest of the floor can carry on as before.

An unwritten line gets argued case by case, and the argument usually ends with someone left alone in the room.

Are mobile phones banned from secure areas under ISO 27001 Annex A 7.6?

No. Annex A 7.6 requires control of recording-capable devices, not prohibition. A clear rule of no photography or recording without the named owner's authorisation is enforceable and passes audit. Reserve lockers or device-management enforcement for genuinely high-risk rooms, because a blanket ban in a small comms room fails in week one.

The named owner matters. Someone, usually the IT or security manager, has to be able to say yes, and a short note of who approved what is the record. The legitimate cases are ordinary: an engineer photographing a rack label for a support ticket, or a vendor documenting their own change. A route to ask turns those from breaches into approved exceptions.

A phone ban nobody can enforce isn't a control. It's a rule staff learn to break quietly.

Match enforcement to the risk of the room:

• Most comms rooms: a written no-photography-or-recording rule, briefed to staff and contractors, with the named owner as the authoriser.
• Higher-risk rooms: lockers or storage outside the room, so devices are physically absent rather than politely discouraged.
• Highest-risk rooms: camera disablement through your device-management platform, where the configuration profile is itself the evidence.

The pitfall sits at the extremes: no rule at all, or an absolute ban with no lockers, no authorisation route and no tooling behind it. Both leave you unable to show a control working. The middle path costs a paragraph of policy and a briefing, and it holds because every exception has somewhere to go.

How should vacant secure rooms be locked and checked?

Lock a secure room whenever it is empty, using auto-locking hardware rather than memory. Then put a short periodic check on the calendar, with a named person doing it and a one-line log entry each time. Quarterly can suit a single, rarely used comms room; a busier room needs more.

Hardware does the first job. An auto-locking door re-latches on close, so nobody has to remember a key, and it removes the "I'll only be a minute" propped door. Doors held open for convenience turn the secure area into a corridor, so the rule says the door closes behind you. Fit the hardware only once it lets people out freely, as the fire escape section below explains.

The check takes two minutes:

• Door secure and latched.
• No signs of interference with the lock, cabinets or cabling.
• Nothing left running or lying about that shouldn't be.
• Emergency card still posted and the exit route clear.

The log needs three fields: date, who checked, result. Pick the cadence you will actually keep.

A vacant-room check with no log never happened, as far as an auditor is concerned.

The walk-through is also where drift gets caught. A door found propped, a cable that wasn't there last quarter or an unlabelled device on a shelf all show up in two minutes.

How do secure room locks stay compliant with UK fire escape law?

Life safety wins without exception. Under Article 14(2) of the Regulatory Reform (Fire Safety) Order 2005, emergency doors must open in the direction of escape and must not be locked so they cannot be easily and immediately opened. A secure room must always let people out without a key, with evacuation routes posted inside.

The Regulatory Reform (Fire Safety) Order 2005, Article 14 sets these out in sub-paragraphs (d) and (f). They apply to emergency routes and exits, so your fire risk assessment tells you whether the secure room door is one, and any new locking hardware deserves a check against it before it goes in. A door that needs a key or code to get out is the pattern to remove. Entry from outside stays controlled by badge or key, because the requirement concerns the way out.

Security never wins an argument against escape. Handle the security consequence with alarms and follow-up, such as a door-open alert from the badge system and a check of the room afterwards. One common fix in a small comms room is a push bar or thumb-turn on the inside of the door.

Post the emergency basics inside the area:

• The evacuation route from the room.
• Who to call, with numbers that work.
• What to do if the alarm sounds.

Two pitfalls recur. Emergency information goes out of date or goes missing, and exit routes get obstructed by stored kit. Both belong on the vacant-room check, so they are caught on a schedule rather than by a fire marshal or an auditor.

What evidence and audit questions should you expect for Annex A 7.6?

Auditors test Annex A 7.6 live: they ask the escort whether photos are allowed, who may work alone, and when the room was last checked. Evidence is the documented rules, escort and visitor records, badge logs, inspection logs and briefing records. A sampled gap grades minor; a complete absence of rules grades major.

The evidence set proves the rules operate rather than merely exist:

• Documented working rules, typically a section of the physical security policy.
• Escort and visitor records for third parties who worked in the area.
• Badge logs corroborating who was inside and when.
• Inspection log for vacant-room checks.
• Briefing or awareness records showing the people with access know the rules.
• Device evidence: the configuration profile where tooling restricts devices, or a note of who approved what where authorisation does.
• Emergency procedures visibly posted in the room, because auditors photograph the wall.

Expect these questions, asked while standing in the room:

• "Can I take photos in here?"
• "Who's allowed to work in this room alone, and doing what?"
• "When an engineer comes to fix the air-con, who stays with them?"
• "When was this room last checked while empty, and where's that recorded?"
• "If the alarm went off right now, what do I do, and how would I know?"

Sampling follows the questions. The auditor is a visitor in a secure area, so the escort's behaviour during the visit is tested live. Auditors also trace recent third-party work orders to escort records, check badge logs for the room and look at how regularly the inspection log was filled. Interviews check whether people with access can state the rules without fetching the policy.

Grading follows certification-body practice. The major case is a secure area with effectively no working rules in a firm holding sensitive client data. Minor findings, such as one unescorted third-party visit or a gap in the check log, can aggregate into a major as a pattern, especially when stacked with entry-control findings.

Brief the escort before the audit, not during it. The escort is the first exhibit, and a calm, correct answer to the photo question sets the tone for everything after.

How can you automate the checks behind Annex A 7.6?

Automation at this scale is thin but real: badge logs feeding out-of-hours or lone-entry alerts, vacant-room checks as a recurring ticket, third-party work orders that need a named escort before closing, and device restrictions enforced through device management. One comms room with quarterly checks needs only a recurring task with a photo.

The recurring ticket does the heavy lifting. The check runs on schedule, the assignee attaches a photo and closes it, and the log builds itself. Start there: it takes an hour to set up and yields the most audit evidence per minute. A work-order template with a mandatory escort field then makes the escort rule a precondition of finishing the job, rather than a hope.

Badge alerts need judgement. Routine solo work by vetted staff is allowed, so a lone entry is a prompt for review, not a violation. Out-of-hours entry with no matching ticket is the one to chase.

Device-management enforcement is the only automation that removes trust entirely, so keep it for the rooms whose risk justifies the effort.

For a lean team, the whole system is three or four automations in tools you already run. Evidence accrues while people get on with their jobs, and the audit trail becomes a by-product rather than a project.

Frequently asked questions