Physical security perimeters

Plain-language summary

Drawing clear boundaries around the places that hold information and the equipment that handles it — site, building, secure rooms — and making each boundary strong enough for what sits inside, with no gaps through windows, ceilings or doors left open.

What the clause is really asking

Logical controls mean little if someone can walk in and carry the server out, so this control asks you to decide where the boundaries around your information and its supporting equipment run, and to make each one effective. In practice that means layers: the site boundary, the building shell, and inner zones such as the server room, the HR records store or the engineering office holding customer drawings. The strength of each perimeter should follow the risk assessment for what it protects, and it must be continuous: solid walls and doors, locks and alarms on external doors and reachable windows, fire exits that alarm when opened, and no false ceiling or raised floor that bypasses a locked room. The misunderstanding is applying office thinking to a manufacturing site; plants and warehouses have roller doors open for hours during dispatch, contractor gates and network cabinets out on the production floor, and those are the real gaps. If you run ISO 45001 or keep a site security plan for your insurer, the fencing, gatehouse and zone drawings already exist.

What auditors look for

Auditors ask for a site plan showing the perimeters and zones, then walk them. They check that server room walls run slab to slab, try doors that should be locked, look for propped-open fire exits and reachable windows, and follow the route a delivery driver or contractor takes. On a manufacturing site they watch dispatch doors during loading, the gatehouse process and network cabinets on the floor. They compare the zones with the risk assessment and ask how perimeter strength was decided. The hard question: show me every way into the server room, including over the ceiling.

Typical evidence

Site and building plans marking perimeters and security zones; physical security risk assessment; perimeter inspection checklists and records; alarm and door-contact configuration for external doors and fire exits; maintenance records for fences, gates and locks; insurer or security consultant survey reports; log of perimeter defects and repairs.

How to comply — recommendations

Mark up a site plan with three or four zones: public, general working areas, restricted (offices with sensitive data, production control rooms) and secure (server room, records store). For each zone note the perimeter: fence, wall, door type, lock, alarm. Walk it with facilities and the security contractor and log every gap, including ceilings, windows and dispatch doors. Fix the cheap ones first: door closers, alarms on fire exits, a locked cage around floor network cabinets. Add a quarterly perimeter inspection to the facilities checklist you already run for safety, and update the plan whenever buildings or layouts change.

Common nonconformities

No defined perimeters or zones; server room reachable over a false ceiling or through a partition wall; fire exits propped open without alarm; ground-floor windows unsecured; dispatch doors left open and unsupervised; network cabinets on the production floor unlocked; perimeter never inspected; site plan out of date after building changes.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.