ISO 27001 A.7.1: Physical security perimeters

Start with a physical security assessment. Walk the site and identify every area that holds sensitive information or processing equipment. Draw up a zoning map with clear categories: public areas (reception, lobbies), controlled areas (general office space), restricted areas (server rooms, network closets), and high-security areas (data centres, archive rooms). For each zone, put appropriate barriers in place. External perimeters need solid construction, locked doors and windows, security fencing where applicable, and vehicle barriers for high-risk sites. Internal perimeters need walls that go from real floor to real ceiling - not partition walls you can climb over - plus controlled-access doors with proper locking mechanisms. Fit access control at every entry point. Electronic badges or cards work for most zones. Add biometric readers for high-security areas. Use PIN keypads as a secondary factor where needed. For data centres, consider mantrap or airlock configurations. Staff reception for visitor management at the main entrance. Layer in detection and monitoring. Install intruder detection - door contacts, motion sensors, glass break sensors, vibration sensors as appropriate. Put CCTV at entry points and along perimeters. Add security lighting around external boundaries. For high-value facilities, consider on-site security guards. Sort out emergency access. Fire exits must meet safety regulations, but they also need to alert security when used. Define how you re-secure the perimeter after an emergency evacuation. Inspect everything regularly. Check walls, doors, windows, and locks for damage. Verify access control systems are working. Test alarms and detection systems. Review CCTV footage coverage for blind spots. Fix deficiencies quickly - an auditor who spots a broken lock on a server room door will not be impressed.