ISO 27001:2022 · Physical controls
ISO 27001:2022 7.1: Physical security perimeters
ISO 27001:2022 7.1 covers Physical security perimeters. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.1, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is False ceilings or raised floors let people bypass walls around secure rooms.
The organization is to define security perimeters and use them around areas holding information and other associated assets. Purpose (stated in ISO/IEC 27002:2022): keeps unauthorized people out and protects information and assets from physical harm or tampering. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.1.
What evidence supports 7.1?
- Annex A physical controlStatement of Applicability entry for control A.7.1, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlSite plans showing defined security perimeters and their strength relative to the assets inside
- Annex A physical controlPhysical security surveys or assessments of walls, roofs, floors, doors, windows and vents
- Annex A physical controlRecords of external door protection such as locks, bars and alarms
- Annex A physical controlAlarm, monitoring and test records for perimeter fire doors, including fail-safe operation
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.1, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- False ceilings or raised floors let people bypass walls around secure rooms
- Fire doors on the perimeter are propped open or not alarmed
- Ground-floor windows and ventilation ducts are unprotected
- Perimeters are not reassessed after building alterations
How it maps to SOC 2
- CC6.4 high Physical security perimeters restrict physical access to protected facilities.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.