Physical entry

Plain-language summary

Controlling who gets into secure areas and how — access cards, keys, visitor sign-in, escorts and controlled delivery points — so that only authorised people enter, entry is recorded, and access ends when it is no longer needed.

What the clause is really asking

Perimeters only work if the doors in them are controlled, and this control asks you to manage the ways into secure areas so that only authorised people get through. That covers the access method (cards, codes, biometrics, keys), authorising and periodically reviewing who has access, removing access for leavers, visitor management (identification, sign-in, badges, escort, sign-out), and records that show who entered when. The 2022 edition also folds in delivery and loading areas, so receiving and dispatch must be arranged so that drivers and couriers cannot wander from the bay into the plant or offices. The misunderstanding is that installing a card system is the control; auditors care about the review of who holds cards, the key register for doors the cards do not cover, and tailgating. In South Africa, biometric readers used for access or time-and-attendance process special personal information under POPIA section 26, so you need a lawful basis such as consent, an alternative for people who object where practical, and protection for the stored templates.

What auditors look for

Auditors ask for the access list for each secure area and compare it with the current staff list and roles, looking for leavers, contractors whose work has ended and people with no need. They ask for the last access review. They pull a few days of the visitor log and follow a visitor's route: sign-in, ID checked, badge, escort, sign-out. They check the key register and ask where the master keys are. At the delivery bay they watch what a driver can reach. They test tailgating at the main entrance. The hard question: who has access to the server room right now, and why?

Typical evidence

Physical access procedure; access lists per secure area with authoriser; periodic access review records; leaver access removal records; door access logs; visitor register with identification, host, times and badge return; key register and key audits; delivery and loading area arrangements; documented POPIA basis and consent for biometrics where used.

How to comply — recommendations

Write a one-page physical access procedure that names an owner for each secure area who approves access. Export the access list from the card system every quarter and have each owner sign it off, removing anyone without a need. Link card cancellation to HR's leaver process. Keep a key register and count keys yearly. Use a visitor book or tablet that records ID, host and times, issue visible badges and require escorts in restricted zones. Separate the delivery bay from production and offices with a door, gate or marked line, and keep drivers at the bay. If you use biometrics, record the POPIA basis and offer an alternative.

Common nonconformities

Leavers' access cards still active; no access review for secure areas; visitor log incomplete or missing exit times; visitors unescorted in restricted areas; key register missing or keys unaccounted for; delivery drivers able to walk into production or offices; tailgating common at controlled doors; biometric data processed with no documented POPIA basis.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.