ISO 27001 Control A.7.6: Working in Secure Areas

Controlling who may enter a secure area is only part of the job. Once someone is inside a server room, a records store or a lab, how they behave matters just as much: whether they work alone, whether they bring a phone or camera, whether the engineer fixing the air conditioning is supervised. A.7.6 covers those rules. It is the sixth of 14 physical controls in our walk through Annex A.

The risk is easy to underestimate. Secure areas often see the most privileged and least supervised activity in a building, such as maintenance contractors, cleaners and supplier engineers. A door that only the right people can open does not help if everyone inside is trusted without question to do whatever they like.

What the control requires

Annex A control 7.6 of ISO 27001:2022 states that security measures for working in secure areas shall be designed and implemented.

The key elements:

Secure areas - the spaces you have designated as needing extra protection, such as server rooms, comms rooms, archives, secure offices and laboratories
Security measures for working in them - rules about conduct, supervision, equipment and activity once inside, not only about entry
Designed and implemented - the measures are thought through for each area and genuinely followed

A.7.6 is a preventive control - it reduces the chance that someone with legitimate access causes harm, intentionally or by accident. Annex A states the control; ISO 27002 gives guidance, including the idea that people should only know about a secure area and its activities on a need-to-know basis. Where physical entry governs crossing the boundary, this control governs what happens on the other side.

How to implement working in secure areas

Define the rules for each area

Not every secure area needs the same rules. A comms cupboard visited twice a year differs from a data centre suite used daily. For each designated area, write down what is and is not allowed. Typical rules include:

Only staff who need to be there are told about the area and what goes on in it
Unsupervised working is avoided where it creates risk, and vacant areas are locked and checked periodically
Photographic, video, audio and other recording equipment, including phones, is not allowed unless authorized
Food, drink and other items that could damage equipment or hide a device are kept out
Doors are not propped open and no one admits others without authorization

Keep the rules short enough that people can remember and follow them, and display the essentials at the entrance of the area.

Supervise third parties and visitors

Contractors and visitors deserve particular attention. Escort them, record when they enter and leave, and brief them on the rules before they go in. For work that needs to be done by a supplier, such as hardware maintenance or cabling, agree the scope beforehand and check that what they actually do matches it. Where possible, have someone who understands the equipment watch the work, not just stand at the door. Our post on physical entry covers visitor registration, which supports the supervision described here.

Contractors should also be bound by confidentiality obligations before they see anything sensitive, in line with confidentiality agreements.

Control equipment and materials

Decide what may be brought in and taken out. Laptops, USB drives and personal devices can move data out as easily as they can carry malware in. Some organizations keep a controlled kit for secure rooms; others log every item taken in and out. Unused areas should be physically locked and inspected so that nothing is left behind, installed or removed without anyone noticing, and so that you notice when something has changed. Dispose of any media or paperwork created in the area through approved routes.

Train people and check that it works

Rules only hold when people know them. Include secure-area conduct in induction and awareness, education and training for everyone with access, and brief contractors at the door. Spot checks, review of access and visit logs, and walk-throughs show whether the rules are followed in practice. When behavior drifts, for example when a propped door becomes normal on busy days, deal with it quickly; the disciplinary process provides a fair route when rules are broken repeatedly or deliberately.

A.7.1 connection. Physical security perimeters identify which areas count as secure and need extra rules.

A.7.2 connection. Physical entry determines who gets through the door; this control covers how they behave inside.

A.7.3 connection. Securing offices, rooms and facilities provides the design foundation that these working rules build on.

A.7.4 connection. Physical security monitoring detects breaches of the rules, for example someone working unsupervised after hours.

A.6.6 connection. Confidentiality agreements bind the contractors and suppliers who are often the people working in these spaces.

A.6.3 connection. Awareness, education and training is how people learn the rules.

Forward reference. Clear desk and clear screen, and equipment siting and protection, extend this thinking to the rest of the working environment; we cover them later in the Annex A series.

What auditors check

Defined rules for secure areas. Auditors look for written rules per area, and compare them with what staff and contractors actually say and do.

Supervision and escort records. Visit logs, escort arrangements and evidence that third-party work was supervised show that the rules are applied.

Equipment restrictions. They ask whether recording devices and removable media are controlled, and how exceptions are authorized.

Empty areas. Auditors check that unoccupied secure areas are locked and periodically inspected.

Awareness. Interviews with staff, contractors and facilities teams reveal whether the rules are known beyond the policy document.

Review and enforcement. Records of spot checks and the handling of breaches show the control is maintained.

Common mistakes to avoid

Focusing only on the door. Strong entry control with no rules for conduct inside leaves the highest-risk activity unmanaged.

Unescorted contractors. A supplier engineer left alone in a server room is one of the most common findings in physical audits.

Phones and cameras everywhere. Where recording is a real risk, the default has to be no devices unless authorized.

Rules nobody has read. A policy that lives in a folder does not change behavior. Display the key points and cover them in training.

Same rules for every area. Over-restricting low-risk spaces breeds workarounds, while under-restricting critical ones leaves gaps. Fit the rules to the risk.

Propped doors and informal access. The convenience of leaving a door open on a busy day is exactly the habit an intruder relies on.

How 27kay can help

We help organizations write practical rules for their secure areas, the kind people actually follow, and set up the supervision and evidence that go with them. As part of ISO 27001 implementation, we review your restricted spaces, align the rules with your contractor arrangements and training, and prepare you for the questions auditors ask. For the full picture, see our ISO 27001 knowledge hub.

Who is allowed to work alone in your server room, and who is watching the engineer who is in there today? Get in touch - we will help you answer both with confidence.