ISO 27001 Control A.7.2: Physical Entry

Once you have defined where your security perimeters sit, the next question is how anyone actually gets through them. A.7.2 requires secure areas to be protected by appropriate entry controls and access points. It is the control that turns a perimeter from a line on a drawing into something a person has to be authorized to cross. This is the second of 14 physical controls in our walk through Annex A.

This is also one of the controls where the gap between “we have a policy” and “we have evidence the policy holds up” shows most clearly. Most offices have some kind of badge system or locked door; far fewer can produce a current access list, a visitor log that has actually been used all week, and a clean answer for what happens when a badge stops working.

What the control requires

Annex A control 7.2 of ISO 27001:2022 states that secure areas shall be protected by appropriate entry controls and access points.

The key elements:

Secure areas - the zones defined under physical security perimeters
Appropriate entry controls - the mechanism (badge, PIN, key, biometric, staffed reception) should match the sensitivity of what is inside
Access points - every way in, including side doors, loading bays, and shared entrances, not just the main door

A.7.2 is a preventive control - it stops unauthorized people from getting into a secure area in the first place. Annex A states the control; ISO 27002 gives guidance on choosing and operating entry controls. This is distinct from securing the space once someone is inside, which the next control in this series addresses.

How to implement physical entry

Scale the control to the area’s sensitivity

Not every secure area needs the same mechanism. A general office might use a single badge reader at the main entrance, while a server room or records archive might need a badge plus PIN, a mantrap, or a staffed checkpoint. Choosing a control that is stronger than necessary everywhere wastes money and trains people to bypass it; choosing one that is weaker than necessary anywhere defeats the perimeter it is meant to protect. Match the mechanism to the layer, as set out in the perimeter design.

Handle visitors and contractors as a distinct category

Visitors, couriers, and contractors need a path that is visibly different from staff access - a sign-in log, a visible visitor badge, and an escort or supervision requirement for anyone entering a secure area who is not staff. Unescorted visitors are one of the most common gaps auditors find, because a friendly reception desk is often the softest part of an otherwise well-controlled building.

Keep the visitor process itself simple enough that reception staff actually follow it every time. A sign-in book that requires five fields nobody checks trains people to skip it under pressure; a name, company, host, and time in and out is usually enough to be useful without becoming a chore.

Keep access lists tied to employment status

An entry control is only as good as the list of people it lets through. Badge and key access should be granted, changed, and revoked as part of the same process that handles onboarding, role changes, and termination - not as a separate, forgettable step. A former employee’s badge still working a month after departure is a finding waiting to happen, and it happens more often than most organizations expect.

This applies just as much to role changes as to departures. Someone who moves from an operations role into finance may no longer need access to a comms room, and someone promoted into IT may need access they never had before. Access reviews that only trigger on joining and leaving miss this middle case, so build a periodic review into the schedule as well, not just an event-driven one.

Log entries and review them

Where the entry mechanism can log activity - electronic badges, sign-in sheets, camera-linked access - use that log. Reviewing entry logs periodically, and especially after an incident, helps confirm the control is actually working and not just present. We cover the monitoring side of this in more depth later in the physical theme.

Plan for failure and exception cases

Entry controls eventually fail or get bypassed in ways a policy document does not anticipate: a badge reader loses power, a fire alarm forces doors open, a delivery needs a side entrance propped for twenty minutes, or a new starter arrives before their badge is provisioned. Decide in advance how each of these is handled - a documented fallback procedure, a manned override, a temporary visitor badge with an escort - rather than leaving staff to improvise a workaround under time pressure. Workarounds invented on the spot are how a well-designed entry control quietly becomes optional, and they are exactly what an auditor asks about when a door is found propped open during a site visit.

A.7.1 connection. Physical security perimeters define the boundaries this control enforces - entry controls without defined perimeters have nothing consistent to protect.

A.7.3 connection. Securing offices, rooms and facilities picks up once someone has legitimately entered, addressing the layout and protection of the space itself.

A.6.5 connection. Responsibilities after termination or change of employment should explicitly include badge and key return - physical access revocation is as important as revoking system accounts.

Forward reference. Physical security monitoring and working in secure areas both build directly on the entry controls set up here; we cover each later in the Annex A series.

What auditors check

Entry controls matching the area. Auditors expect the mechanism to fit the sensitivity of what is behind it, and will question a server room secured with nothing more than the same badge that opens the front door.

Current access lists. They typically sample who has access to a secure area and cross-check it against current employment or role records, looking for anyone who should have been removed.

Visitor handling. Auditors check for a visitor log, visible identification, and evidence that visitors are escorted or otherwise supervised in secure areas.

Every access point, not just the obvious one. They ask about side doors, loading docks, fire exits, and shared building entrances - access points people forget because they are not the one used daily.

Response to a lost credential. They look for a documented process for reporting and acting on a lost badge or key, and evidence it has actually been used.

Common mistakes to avoid

Only securing the front door. Side entrances, delivery bays, and fire exits are common blind spots that undermine an otherwise well-controlled main entrance.

Stale access lists. Access that is granted but never reviewed accumulates former employees, former contractors, and roles that no longer need entry.

No distinction for visitors. Treating visitors the same as staff, or not tracking them at all, removes the accountability a visitor log is meant to provide.

Shared credentials. A single PIN or key shared among a team cannot be tied to an individual and cannot be revoked for just one person.

Disconnecting access control from HR processes. If badge deactivation is not part of the offboarding checklist, it depends on someone remembering - which eventually fails.

No plan for when the control fails. Fire alarms, power outages, and rushed deliveries all create moments where entry controls get bypassed - without a documented fallback, staff improvise, and improvisation is where the control quietly stops working.

How 27kay can help

We help organizations design entry controls that fit each area’s sensitivity and tie access lists directly into onboarding and offboarding, so nobody’s badge outlives their employment. As part of ISO 27001 implementation, we review your access points, help you close the gaps auditors find most often, and connect physical access to the same process as your other joiner-mover-leaver controls. For the full picture, see our ISO 27001 knowledge hub.

Could a former employee still badge into your office today? Get in touch - we will help you find out, and fix it before an auditor does.