ISO 27001 Annex A
Physical security for a company whose servers it never sees.
Theme 7 holds 14 controls on buildings, rooms, equipment and media. A company with racks in its own building runs most of them directly. A cloud-only company passes the data-centre part to its provider and keeps the rest: laptops, home desks, a shared office, old drives. This page covers every control and both situations.
Back to ISO 27001 services01 · Three groups
Fourteen controls in three groups
Keep the wrong people out, keep the equipment working, and keep information from walking away.
| Group | Controls | Cloud-only company: who usually runs it |
|---|---|---|
| Keeping people out | 7.1, 7.2, 7.3, 7.4, 7.6 | Cloud provider for data centres; building or co-working operator for the office |
| Equipment and its environment | 7.5, 7.8, 7.11, 7.12, 7.13 | Mostly the provider; you still own laptops and any office network kit |
| Desks, devices and media | 7.7, 7.9, 7.10, 7.14 | You, almost entirely |
02 · Keeping people out
Perimeters, entry and monitoring
Five controls that decide who can physically reach information and equipment.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 7.1 Physical security perimeters | Draw a boundary around places that hold information or equipment | The office floor and any locked room for network kit, marked on a plan | The plan and a description of each boundary |
| 7.2 Physical entry | Only allowed people get in | Badge access, a visitor log, escorts for visitors | Badge list compared with current staff; the visitor log |
| 7.3 Securing offices, rooms and facilities | Offices and rooms are designed with security in mind | Locked cupboards for devices; screens facing away from windows | A short walk-through note or photos |
| 7.4 Physical security monitoring (new in 2022) | Notice when someone gets in who should not | Alarm, building guard or camera, often supplied by the building | The landlord's or operator's description of monitoring |
| 7.6 Working in secure areas | Rules for working inside sensitive rooms | No unescorted visitors in the network room; no photos | The rule and the room's entry record |
03 · Equipment
Equipment and its environment
Protect hardware from fire, water, power loss, damage and neglect.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 7.5 Protecting against physical and environmental threats | Plan for fire, flood, heat and other physical events | Building fire systems; nothing critical on the office floor | Building safety certificates; the risk register entry |
| 7.8 Equipment siting and protection | Place equipment where it is safe from harm and prying eyes | Network kit in a locked cabinet; printers away from public areas | Location of each item in the inventory |
| 7.11 Supporting utilities | Equipment keeps running when power or cooling fails | A UPS for office network kit; production in the cloud | UPS test record or the provider's assurance report |
| 7.12 Cabling security | Cables cannot be tapped or cut easily | Cabling inside walls or trunking; network cabinet locked | A walk-through note; in a shared office, the operator's statement |
| 7.13 Equipment maintenance | Equipment is maintained so it stays reliable and secure | Vendor warranty and repair through approved channels; wipe before repair | Repair records and the wipe step |
04 · Desks and devices
Desks, devices and media
The group no company can hand off. Laptops and drives carry the data.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 7.7 Clear desk and clear screen | Nothing sensitive is left visible on desks or unlocked screens | Auto screen lock enforced by device management; a clear-desk rule | Device policy showing the lock timeout |
| 7.9 Security of assets off-premises | Company devices stay protected outside the office | Disk encryption, remote wipe, a rule for travel | Device compliance report for all laptops |
| 7.10 Storage media | Removable media is controlled through use, transport and disposal | USB storage blocked or limited; encrypted drives where needed | Device policy and an exception list |
| 7.14 Secure disposal or re-use of equipment | Data is wiped or destroyed before equipment is reused or thrown away | Wipe through device management; certified destruction for failed drives | Wipe records or destruction certificates |
05 · Cloud-only companies
How a cloud-only company covers the data-centre controls
You cannot walk your provider's data hall. You rely on its assurance, through your supplier controls.
Your cloud provider handles
- Data-centre perimeter, entry and monitoring
- Fire, flood, power and cooling
- Server cabling and maintenance
- Destruction of failed provider disks
You still handle
- Laptops at home, in transit and in the office
- Screen lock and clear desk
- Removable media and old devices
- Choosing and reviewing the provider (5.19 to 5.23)
The provider's controls do not appear in your ISMS as yours. They are covered by reviewing the provider's own certificate or assurance report under the supplier and cloud controls.
In the Statement of Applicability, keep the data-centre controls applicable and say how they are met: by the provider, checked through its published ISO 27001 certificate or SOC 2 report, reviewed each year. Marking them simply not applicable invites a question, because your data does sit in a building somewhere.
06 · Home offices
Home offices and shared spaces
For a remote team, the home desk is the office. Treat it that way, within reason.
- Managed device only. Company data on company laptops enrolled in device management.
- Encryption and lock. Full-disk encryption on, short screen-lock timeout enforced centrally.
- Private screens. No customer data on screen in cafes, trains or shared rooms.
- No paper, or locked paper. Printing discouraged; anything printed is shredded.
- Co-working spaces. The operator's access controls recorded as a supplier, with its terms on file.
Nobody expects an auditor to visit staff homes. The proof for home working comes from device reports and signed rules, which cover most of theme 7 for a remote company.
07 · Evidence
What replaces a site walk
When there is little to walk through, the auditor reads records instead.
- The cloud provider's current ISO 27001 certificate or SOC 2 report, with your review note on it.
- A device compliance report showing encryption, screen lock and patch level for every laptop.
- Wipe or destruction records for devices retired during the audit period.
- The office lease or co-working terms, and the operator's description of entry and monitoring.
- Signed remote-work and clear-desk rules for a sample of staff.
Certification bodies commonly run part of an audit remotely, and whether a site visit is needed for a small office is their decision, made under their own procedures. If you have an office, expect a short look at it.
Sources: ISO/IEC 27001:2022 Annex A control numbers and names; ISO/IEC 27002:2022 for the purpose of the physical controls, described in our own words; IAF mandatory documents on the use of remote audit techniques. The standards are copyrighted and are not reproduced here.
Questions about the physical controls
Can a cloud-only company exclude all physical controls?
No. Laptops, screens, media and disposal still apply.
Controls 7.7, 7.9, 7.10 and 7.14 concern devices and media your team holds, so they stay with you. The data-centre controls are met through your provider, and the SoA should say so rather than exclude them.
We work from a co-working space. Who owns entry and monitoring?
The operator runs them; you record and review that.
Treat the operator as a supplier. Keep its terms, a description of its access control and monitoring, and a note of your yearly review. Keep your own devices locked away when you are not there.
Does physical security monitoring mean we need cameras?
Not necessarily. Monitoring must fit the risk.
Control 7.4, new in 2022, asks you to notice unauthorised physical access. Depending on the site that might be an alarm, a guard, badge logs or cameras run by the building. A home office or shared desk usually relies on the device controls instead.
What counts as secure disposal of a laptop?
A verified wipe, or destruction with a certificate.
Use a wipe method that removes data beyond recovery, record it per device, and keep destruction certificates for drives that cannot be wiped. Match the records against the asset inventory.
Settle which physical controls are really yours.
An ISO 27001 gap analysis splits theme 7 between you and your providers, and lists the records that stand in for a site walk.