Working in secure areas

Plain-language summary

Setting the rules for how people behave inside secure areas — who may be there, what they may bring and do, how third parties are supervised and how empty areas are checked — so the protection of the room is not undone by the people working in it.

What the clause is really asking

A secure area is only as secure as the habits inside it, and this control asks you to set and enforce rules for activity in those areas. The rules typically cover: people knowing about the area and what happens there only as far as their work requires; no unsupervised work, particularly by third parties such as air-conditioning technicians or cleaners; empty secure areas locked and checked periodically; no photography, video or recording, including phone cameras, unless authorised; and the routine for entering, working and leaving. The rules apply to everyone in the area, your own staff included. The misunderstanding is that physical entry (7.2) is the whole story; entry gets someone in, and this control governs what they do once inside. In manufacturing, secure areas can include prototype build areas, tool rooms holding customer tooling data and the production control room, and automotive suppliers will recognise these ideas in TISAX prototype protection. The ISO 45001 permit-to-work and contractor induction you already run are natural vehicles for these rules.

What auditors look for

Auditors ask for the rules for each secure area and look for them posted at the entrance. They ask how contractors working in the server room or prototype area are supervised and trace one recent job from the work order or permit to the escort and sign-out. They ask about phones and cameras inside and whether empty areas are checked. They interview someone who works in the area about the rules. The hard question: who was with the air-conditioning technician when he worked in the server room last month?

Typical evidence

Working rules for each secure area, posted at entrances; list of secure areas and their owners; contractor permit-to-work or work order records naming the escort; secure area entry and exit logs; inspection records for vacant secure areas; rules on photography and recording devices; briefing records for people who work in secure areas.

How to comply — recommendations

Write one page of rules per type of secure area and post it at the door: who may enter, escort requirement for third parties, phones and cameras, nothing left unattended, and the last person out checks and locks. Route all third-party work in secure areas through your existing permit-to-work or work order process with a named escort. Add the secure area rules to the contractor induction you already run for safety. Put vacant secure areas on the guard's patrol checklist. Brief everyone who works in a secure area once a year and record it.

Common nonconformities

No defined rules for working in secure areas; third-party technicians working unsupervised in the server room; photography in prototype areas unchecked; secure areas left unlocked when empty; no record of who escorted contractors; staff working in secure areas unaware of the rules; rules written but neither posted nor enforced.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.