ISO 27001 Control A.7.1: Physical Security Perimeters

With the eight people controls done, we move into Annex A’s physical theme - 14 controls covering everything from the front door to the disposal bin. A.7.1 is the natural starting point, because every other physical control assumes you already know where your boundaries are. It requires security perimeters to be defined and used to protect areas that contain information and other associated assets. Skip this one, and “physical security” becomes a vague feeling instead of a documented, auditable set of zones.

It is easy to underestimate this control because most organizations already have locked doors and some notion of who can go where. The gap auditors find is rarely the absence of any physical security - it is the absence of a deliberate, documented boundary that someone actually designed, rather than one that simply exists because a previous tenant put up a wall in a convenient place.

What the control requires

Annex A control 7.1 of ISO 27001:2022 states that security perimeters shall be defined and used to protect areas that contain information and other associated assets.

The key elements:

Defined - perimeters are explicit and documented, not implied by which door happens to lock
Used - a perimeter on a diagram that nobody enforces is not a perimeter
Areas that contain information and other associated assets - offices, server rooms, archive rooms, delivery areas, anywhere paper, devices or people carrying knowledge are present

A.7.1 is a preventive control - it stops unauthorized physical access before it happens, rather than detecting or reacting to it. Annex A states the control; ISO 27002 gives guidance on how to design and layer perimeters. Your Statement of Applicability records which locations are in scope and how this control applies to each.

How to implement physical security perimeters

Map assets to physical space first

You cannot draw a sensible perimeter without knowing what is inside it. Walk the same asset inventory work you use for information assets and ask where each one physically sits: which room holds the server rack, where paper contracts are filed, which desks handle client data, where laptops are stored overnight. This mapping, tied to your ISMS scope, tells you which spaces need a perimeter at all - a shared kitchen usually does not; a room with a domain controller does.

Build layers, not one wall

Treat physical security like an onion rather than a single fence. A typical office might have an outer perimeter at the building entrance, a middle perimeter at the tenant’s own door, and an inner perimeter around a server room or records archive. Each layer should require progressively more to get through, so that reaching the most sensitive area means passing several checks, not just one lock. We cover how to enforce each layer with entry controls in the next control in this series.

How many layers you need depends on scale, not ambition. A five-person consultancy in a single rented office might reasonably have two layers - the building’s own entrance and the tenant’s front door - plus a locked cabinet for the one thing worth protecting further. A larger organization with a dedicated server room, a records archive, and a reception area open to the public genuinely needs three or four distinct layers. Adding more layers than your risk profile justifies mostly adds friction for staff without adding real protection, which is its own kind of failure.

Match construction to what you are protecting

A perimeter is only as strong as its physical materials. Walls that stop at a suspended ceiling, glass partitions, or doors with weak frames undermine an otherwise sensible zone plan. For higher-value areas, consider floor-to-slab walls, solid doors, and windows that cannot be forced without obvious damage. The strength of construction should scale with the sensitivity of what sits inside, not be uniform across the building.

Document and keep the picture current

Auditors and your own team need a current record of where perimeters are and what they protect - a simple floor plan with zones marked is usually enough. Review it whenever you move offices, add a location, change a lease, or start using coworking or shared space, since perimeter boundaries drawn for one floor plan rarely survive a move unchanged.

Plan for the edges of the perimeter, not just the walls

Perimeters fail most often at their edges rather than in the middle of a wall: a false ceiling that runs continuously above two rooms with different sensitivity, a shared riser or duct that passes through a “secure” zone, a fire exit that opens the inner perimeter straight onto the street, or a window at ground level behind what looks like a solid wall on the floor plan. When you define a perimeter, walk it physically and check what lies above, below, and immediately outside it, not only what is drawn on paper. Multi-tenant buildings add another edge case worth planning for explicitly: a shared corridor, lift lobby, or loading area often sits between your own perimeter and the building’s outer wall, and the building operator’s control over that space is rarely as strong as you would design yourself.

A.7.2 connection. Physical entry is how you enforce the perimeters this control defines - a perimeter without entry controls is just a line on a drawing.

A.7.3 connection. Securing offices, rooms and facilities addresses the space inside a perimeter, once the boundary itself is set.

Clause 4.3 connection. Your ISMS scope determines which physical locations need perimeters defined in the first place - a location outside scope does not need this control applied, but the boundary of scope itself should be defensible.

Forward reference. Physical security monitoring, working in secure areas, and equipment siting all build on the perimeters this control establishes; we cover each later in the Annex A series.

What auditors check

A documented set of perimeters. Auditors expect a floor plan or equivalent showing where boundaries sit and what each one protects, not a verbal description.

Consistency with the asset inventory and scope. They check that the areas holding in-scope assets actually have a perimeter defined around them, rather than assuming the whole building counts.

Physical evidence during a site visit. Where a visit is possible, auditors walk the perimeters themselves, looking for gaps - an unlocked side door, a dropped ceiling that bridges two “secure” rooms, a window that opens onto a public path.

Currency. They ask when the perimeter documentation was last reviewed and whether it reflects the current office layout, especially after any move or expansion.

Alignment across sites. Where an organization runs more than one office, warehouse, or data centre, auditors expect the same disciplined approach to perimeter definition applied consistently, not a well-documented headquarters and an ad hoc branch office.

Common mistakes to avoid

Treating the whole office as one zone. A single perimeter around the entire office misses that a server room or HR filing cabinet needs a tighter boundary than the open-plan floor.

Perimeters that exist only on paper. A diagram with zones marked, where the actual doors are propped open or the boundary walls have gaps, gives auditors and attackers the same weakness.

Ignoring shared or leased space. Coworking desks, shared server rooms, and multi-tenant buildings need explicit thought about where your perimeter starts, since you do not control the building’s outer layer.

Forgetting to update after a move. Office relocations and expansions are the most common reason perimeter documentation goes stale - update it as part of the move checklist, not as an afterthought before the next audit.

No link to the asset inventory. Drawing perimeters without first knowing what is inside them leads to boundaries around the wrong rooms.

Overlooking building-level edges. False ceilings, shared risers, and fire exits are easy to miss on a floor plan but are exactly where a perimeter tends to leak in practice.

How 27kay can help

We help organizations map their physical spaces to their information assets and design perimeters that are both defensible in an audit and practical to run day to day. As part of ISO 27001 implementation, we walk your sites, help you define zones that match real risk, and document them in a form auditors recognise. For the full picture, see our ISO 27001 knowledge hub.

Not sure where your security perimeters actually are, or whether they match what is on the diagram? Get in touch - we will help you turn a rough sense of “secure areas” into a documented, defensible boundary.