ISO 27001 A.7.2: Physical entry

Map entry controls to your security zones. General office areas get electronic badge readers at main entry points. Restricted areas like server rooms and network closets get two-factor physical authentication (badge plus PIN or badge plus biometric). High-security areas should have mantrap doors, anti-tailgating controls, and multi-factor authentication. Set up a proper visitor management process. Register all visitors at reception before they enter controlled areas. Check government-issued ID. Issue temporary visitor badges that look obviously different from employee badges. Require escorts in restricted areas. Log entry and exit times. Collect badges when visitors leave. Handle contractor and maintenance access with care. Pre-authorise visits through a formal request process. Verify identity on arrival. Issue temporary badges restricted to the relevant zones. Decide whether each contractor type needs an escort or can work unescorted, and document the rationale. Revoke temporary access the moment work is finished. Set up delivery management. Designate a loading dock or reception area that is separated from secure zones. Inspect incoming deliveries before moving them into restricted areas. Log everything. Never let delivery personnel wander into restricted areas unescorted. Keep access logs for every entry point. Electronic systems should log every badge swipe with a timestamp automatically. For manually controlled doors, maintain a sign-in sheet. Review logs regularly for red flags - unusual access times, repeated failed attempts, access by people who should not be in that zone. Define a retention period and stick to it. Review physical access rights on a regular cycle. Confirm that each person's access matches their current role. Remove access for leavers and role-changers promptly. Audit active badges to make sure none belong to people who left six months ago. Test the entry controls periodically, including anti-tailgating measures.