ISO 27001:2022 · Physical controls
ISO 27001:2022 7.3: Securing offices, rooms and facilities
ISO 27001:2022 7.3 covers Securing offices, rooms and facilities. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.3, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Data rooms are labelled or signposted for convenience.
The organization is to design and implement physical protection for its offices, rooms and facilities. Purpose (stated in ISO/IEC 27002:2022): keeps intruders out of offices, rooms and facilities and protects what they contain. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.3.
What evidence supports 7.3?
- Annex A physical controlStatement of Applicability entry for control A.7.3, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlFacility security design documentation showing critical facilities sited away from public access
- Annex A physical controlPhotographs or survey records confirming the absence of signage revealing processing facilities
- Annex A physical controlAssessments of visual and acoustic leakage from meeting rooms and processing areas, with mitigations such as window film or sound insulation
- Annex A physical controlElectromagnetic shielding assessments where relevant
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.3, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Data rooms are labelled or signposted for convenience
- Screens and whiteboards in sensitive rooms are visible from the street
- Internal maps showing server room locations are published on the intranet or public sites
- Critical equipment is placed in areas the public can reach
How it maps to SOC 2
- CC6.4 high Securing offices, rooms and facilities protects the assets held inside.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.