ISO 27001 A.7.6: Working in secure areas

Define working rules for each category of secure area. Make them proportionate to sensitivity. For server rooms and data centres: restrict access to authorised personnel only, require sign-in and sign-out, enforce a dual-person rule for critical maintenance activities, restrict photography and recording devices, monitor all activity via CCTV, require change management approval before any modifications, and maintain a current list of who is authorised for each specific area. For secure processing areas: implement clean room policies - no personal items, mobile phones, or removable media. Use supervised entry and exit with bag checks where appropriate. Control what materials go in and come out. Monitor via CCTV and access logging. Consider personnel rotation to reduce collusion risk. General rules for all secure areas: lock vacant secure areas and check them periodically, supervise third-party support personnel unless they hold appropriate clearances, restrict or prohibit photography and audio/video recording, ban food and drink near equipment, and define emergency procedures specific to each secure area. Back up the rules with technical controls. Access control systems should restrict entry to authorised people. CCTV should cover the interior of secure areas, not just the doors. For the highest-security zones, consider mobile device detection systems. Train everyone who accesses secure areas on the rules and why they exist. Run periodic compliance checks and audits. Handle violations through the disciplinary process. Review and update the rules as threats and operations change.