ISO 27001:2022 · Physical controls
ISO 27001:2022 7.6: Working in secure areas
ISO 27001:2022 7.6 covers Working in secure areas. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.6, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Staff routinely take phones with cameras into secure areas without authorization.
Security measures for working inside secure areas are to be designed and put in place. Purpose (stated in ISO/IEC 27002:2022): stops people working in secure areas from damaging or tampering with what is kept there. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.6.
What evidence supports 7.6?
- Annex A physical controlStatement of Applicability entry for control A.7.6, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlDocumented rules for working in secure areas that apply to all personnel and activities
- Annex A physical controlRecords restricting knowledge of secure areas to those with a need to know
- Annex A physical controlSupervision or two-person rules and records for work in secure areas
- Annex A physical controlInspection records for vacant secure areas and evidence they are locked
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.6, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Staff routinely take phones with cameras into secure areas without authorization
- Work in data rooms is done alone out of hours with no supervision
- Vacant secure rooms are left unlocked
- Floor plans and descriptions of secure areas circulate widely
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.