Securing offices, rooms and facilities

Plain-language summary

Designing the physical security of the specific offices, rooms and facilities where sensitive work happens — where they sit, how they are built, what can be seen or heard from outside — so the information inside cannot easily be seen, overheard or reached.

What the clause is really asking

Inside the perimeter some spaces matter more than others, and this control asks you to plan and put in place protection for those particular offices, rooms and facilities. The questions are practical: is the key facility placed away from public access and passing traffic; does signage or a building directory advertise where valuable assets are; can information be seen through windows or heard through thin partitions; are sensitive rooms locked when empty; are calls and video meetings in open-plan areas overheard. The misunderstanding is that this is only about the server room. On a manufacturing site it is also the engineering office holding OEM drawings, the quality lab with customer test data, the payroll and HR office, and the control room for production systems. Automotive suppliers that handle prototypes will recognise the same ideas from TISAX prototype protection. If you run an integrated management system, the facility layout, room designations and zones may already be drawn for fire and safety purposes and can carry the security designation as well.

What auditors look for

Auditors walk the offices and facilities named in your risk assessment, noting what they can see and hear from corridors, reception, the canteen and outside windows. They look for signs that label server or records rooms, whiteboards and screens visible to visitors, and sensitive rooms left unlocked when empty. They check the rooms used for confidential discussions and how sound carries. They ask how the location of key facilities was decided. The hard question: if I stood in your reception or car park with a phone camera, what could I record?

Typical evidence

List of sensitive offices, rooms and facilities with their security requirements; floor plans showing designations; physical security risk assessment; walk-through or inspection records; locking and key arrangements for sensitive rooms; window film, blinds or screen positioning where needed; guidance on confidential meetings and calls.

How to comply — recommendations

List the rooms that handle sensitive information and mark them on the floor plan alongside the fire and safety layout. For each, decide what is needed: locked when empty, no external signage, blinds or frosted film, screens turned away from windows and doors. Remove 'Server Room' and similar labels. Route visitors away from engineering, HR and payroll offices. Set aside a quiet room for confidential calls. Run a short quarterly walk-through with a checklist, ideally combined with the clear desk check, and record what you found and fixed.

Common nonconformities

Sensitive rooms left unlocked and unattended; server or records room signposted; confidential drawings or data visible from public areas or through windows; visitor routes pass through engineering or HR offices; confidential conversations overheard in open-plan spaces; no walk-through or inspection of sensitive rooms; key facility sited beside public access.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.