ISO 27001 Control A.7.3: Securing Offices, Rooms and Facilities

Perimeters and entry controls decide who gets into a building or a floor. A.7.3 picks up from there, requiring physical security to be designed and implemented for the offices, rooms and facilities themselves. A visitor who has legitimately signed in at reception should not then be free to wander into the server room or overhear a confidential client call through a glass wall. This is the third of 14 physical controls in our walk through Annex A.

Where the first two physical controls are largely about who gets in, this one is about what they can do once they are legitimately inside. A building with a strong perimeter and disciplined entry control can still leak information badly if the rooms behind that front door are laid out without any thought for what each one holds.

What the control requires

Annex A control 7.3 of ISO 27001:2022 states that physical security for offices, rooms and facilities shall be designed and implemented.

The key elements:

Offices, rooms and facilities - individual spaces within a secure area, not just the building as a whole
Designed - security is a deliberate layout choice, not an accident of where walls happen to be
Implemented - the design is actually built and maintained, not left as an intention

A.7.3 is a preventive control - it reduces the chance that someone with legitimate access to a building can still reach or overhear something they should not. Annex A states the control; ISO 27002 gives guidance on how to design individual spaces. Where physical entry governs who crosses a boundary, this control governs what that boundary looks like once you are past it.

How to implement office and facility security

Design each room for what it actually holds

A server room, an HR office handling personnel files, an open-plan work area, and a public reception should not have the same level of protection - and often should not be visible to each other. Walk the same asset mapping used for perimeters, but at room level: which rooms handle confidential conversations, which hold physical records, which contain infrastructure. Design the layout so the most sensitive rooms sit furthest from public-facing space, not adjacent to the front door for convenience.

This is easiest to get right when it is part of choosing or fitting out a space, and hardest to fix afterward, so raise it early whenever a lease renewal, office move, or refit is being planned. Retrofitting room-level security into an existing layout - moving a server room away from a shared wall, adding a partition around a filing area - is almost always more expensive and more disruptive than designing it in from the start.

Avoid advertising what is inside

Signage that says “Server Room” or “HR - Personnel Files” on a door tells anyone walking the corridor exactly where to target. Use neutral labelling for sensitive rooms, and avoid listing sensitive functions on building directories or floor plans visible to the public. The room should still be easy for authorized staff to find; it should not be easy for anyone else.

Separate public-facing space from working space

Reception areas, client meeting rooms, and delivery points are where outsiders legitimately spend time, and they should be designed so a visitor cannot see into working areas, screens, or filing cabinets from where they are seated. Glass-walled meeting rooms facing a public corridor are a common weak point - fine for a general conversation, unsuitable for anything confidential unless the glass is treated or the room is positioned away from public sightlines.

A simple test works well here: stand where a visitor or delivery courier would stand, and look around. If you can read a whiteboard, see a screen left unlocked, or hear a conversation from the next room, so can they. This test costs nothing and tends to surface problems that a written policy review never would.

Coordinate with landlords and shared-facility operators

In leased or multi-tenant buildings, you do not control the whole structure, so document what you rely on the landlord or building operator for - shared reception, shared server rooms, fire systems, cleaning access - and confirm those arrangements meet your requirements. This matters even more for organizations that also support remote working, where the traditional office is only one of several physical environments handling company information.

Account for third parties who work inside your space

Cleaners, maintenance contractors, and out-of-hours facilities staff routinely have access to rooms that employees only see during working hours, often unsupervised and outside normal business hours when fewer people are around to notice something wrong. Extend the same room-level thinking to them: which rooms genuinely need to be on a cleaning contractor’s access list, whether sensitive rooms can be cleaned during supervised hours instead, and whether contractor access is reviewed with the same discipline as staff access. A room designed well for visitors during the day but left open to an unvetted contractor overnight has not actually been secured, only secured on a schedule.

A.7.1 connection. Physical security perimeters set the outer boundaries; this control addresses the design of the spaces those boundaries contain.

A.7.2 connection. Physical entry governs who is let through a boundary; this control governs what they can see, reach, or overhear once inside.

A.6.7 connection. Remote working extends the same design thinking - securing the space where work happens - to home offices and other locations outside the traditional building.

Forward reference. Working in secure areas and supporting utilities both build on the room-level design set up here; we cover each later in the Annex A series.

What auditors check

Room-level appropriateness. Auditors typically walk a sample of rooms and judge whether the physical protection matches what each one holds - a filing cabinet with client contracts left in an unlocked, publicly accessible room is a common finding.

Sightlines and overhearing. They look at whether confidential conversations or screens in meeting rooms and offices are visible or audible from public or shared areas.

Signage and directories. Auditors check whether sensitive rooms are labelled or listed in a way that identifies their contents to anyone passing.

Shared-building arrangements. Where you lease space, they ask how you have confirmed the landlord’s or co-tenant’s facilities meet your security expectations, particularly for shared server rooms or reception.

Consistency with the asset and perimeter documentation. They cross-check that rooms holding higher-value assets actually receive stronger protection than general work areas.

Common mistakes to avoid

Sensitive rooms labelled openly. A door or directory entry naming a server room or records archive removes the obscurity that helps protect it.

Glass or open-plan meeting rooms used for confidential discussions. Convenient, but visible and audible from public space unless deliberately positioned or treated.

Uniform treatment of all rooms. Applying the same lock and layout to every room regardless of contents wastes effort on low-risk space while under-protecting high-risk space.

No review after a fit-out or move. Office refits routinely change which rooms sit where relative to public areas - review room-level security whenever the layout changes.

Assuming the landlord has it covered. In shared or leased buildings, verify rather than assume that shared facilities meet your requirements.

Overlooking cleaners and out-of-hours contractors. Access that is fine for daytime visitors can be a serious gap when the same room is left open to unsupervised contractors overnight.

How 27kay can help

We help organizations look at their office layout the way an auditor will - room by room, matched against what each space actually holds - and fix the gaps that come from convenience rather than deliberate design. As part of ISO 27001 implementation, we review your facilities, help you prioritise which rooms need attention first, and document the design so it holds up in an audit. For the full picture, see our ISO 27001 knowledge hub.

Could a visitor in your reception area see a screen, hear a call, or read a label they shouldn’t? Get in touch - we will help you walk your own office with an auditor’s eye before someone else does.