Auditing ISO 27001 Annex A 7.1 Physical Security Perimeters is a critical technical examination of structural barriers and entry controls. The Primary Implementation Requirement demands clear boundary demarcation and hardening, ensuring the Business Benefit of preventing unauthorised physical access to sensitive information assets and critical infrastructure.
ISO 27001 Annex A 7.1 Physical Security Perimeters Audit Checklist
This technical verification tool is designed for lead auditors to establish the integrity of an organisation’s structural boundaries. Use this checklist to validate compliance with ISO 27001 Annex A 7.1.
1. Physical Security Perimeter Definition Verified
Verification Criteria: The organisation has clearly defined and documented the physical boundaries of its security perimeters, including all sites, data centres, and office spaces within the ISMS scope.
Required Evidence: Site plans or floor maps showing the physical security boundaries and the location of entry/exit points.
Pass/Fail Test: If the organisation cannot produce a map or diagram that clearly demarcates where the “secure zone” begins and ends, mark as Non-Compliant.
2. External Barrier Structural Integrity Confirmed
Verification Criteria: External walls, fences, and gates are constructed to a standard that prevents unauthorised physical entry and shows no signs of structural bypass vulnerability.
Required Evidence: Physical inspection of external perimeters and maintenance logs for gates/fences.
Pass/Fail Test: If any external wall or fence has a gap larger than 10cm or shows signs of unrepaired damage that allows access, mark as Non-Compliant.
3. Controlled Entry Point Implementation Validated
Verification Criteria: All entry points into secure perimeters are protected by a controlled access mechanism (e.g. badge readers, security guards, or PIN pads).
Required Evidence: Physical sighting of access control hardware and a list of all authorised entry points.
Pass/Fail Test: If a secondary fire exit or delivery door is found unlocked and unmonitored during the audit, mark as Non-Compliant.
4. Reception Area Isolation Verified
Verification Criteria: Public-access areas, such as reception or delivery bays, are physically separated from the internal secure perimeters to prevent tailgating or unauthorised wandering.
Required Evidence: Floor plan showing the buffer zone between reception and secure office space; physical verification of the “lock-gate” or turnstile.
Pass/Fail Test: If a visitor can walk from the street into the main office desks without passing through a secondary locked door, mark as Non-Compliant.
5. External Window and Aperture Hardening Confirmed
Verification Criteria: Windows at ground level or accessible heights are fitted with security film, bars, or reinforced glass to prevent forced entry.
Required Evidence: Technical specifications of window glazing or physical sighting of security grilles/bars.
Pass/Fail Test: If ground-floor windows are made of standard non-reinforced glass and lack security sensors, mark as Non-Compliant.
6. Intruder Detection System (IDS) Coverage Validated
Verification Criteria: An active intruder detection system is installed covering all perimeter boundaries, integrated with an alarm that notifies security personnel of a breach.
Required Evidence: IDS configuration report or recent alarm test logs from the monitoring provider.
Pass/Fail Test: If the IDS has not been tested in the last 12 months or if there are “blind spots” in the perimeter coverage, mark as Non-Compliant.
7. CCTV Surveillance Perimeter Coverage Verified
Verification Criteria: CCTV cameras are positioned to monitor the entire perimeter, providing clear visibility of all entry and exit points in various lighting conditions.
Required Evidence: Live CCTV feed inspection and a camera placement map showing overlapping fields of view.
Pass/Fail Test: If CCTV footage at entry points is too low-resolution to identify a human face or is blocked by foliage, mark as Non-Compliant.
8. Signage and Deterrent Visibility Confirmed
Verification Criteria: Clear signage exists to indicate that the area is private property and under constant surveillance, serving as a legal and psychological deterrent.
Required Evidence: Physical sighting of “Private Property,” “Authorised Access Only,” and “CCTV in Operation” signs.
Pass/Fail Test: If the perimeter lacks signage informing individuals they are entering a secure zone, mark as Non-Compliant.
9. Internal Zone Segregation Integrity Validated
Verification Criteria: High-risk internal areas (e.g. server rooms, archive stores) have their own sub-perimeters that require a higher level of access authorisation than the general office.
Required Evidence: Site map showing “Zones” and physical verification of floor-to-ceiling partitions for server rooms.
Pass/Fail Test: If server racks are located in an open-plan office area without a dedicated physical room/cage, mark as Non-Compliant.
10. Physical Security Review and Maintenance Logs Present
Verification Criteria: The organisation performs regular inspections of the physical perimeter to identify and fix wear and tear or security weaknesses.
Required Evidence: Quarterly physical security inspection reports and evidence of completed repair tickets for doors or locks.
Pass/Fail Test: If there is no record of a physical security walk-around being conducted in the current audit year, mark as Non-Compliant.
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Perimeter Definition | Tool identifies a “Physical Security Policy” exists in the folder. | The auditor must see a physical floor plan. A policy is not a perimeter. |
| Entry Control | Software records that the office has a “Smart Lock” system. | Verify the back door. GRC tools only see the systems you tell them about, not the propped-open fire exit. |
| Window Security | SaaS tool assumes compliance if the site is a “Coworking Space.” | Check the glass. Coworking spaces often prioritise aesthetics over the hardening required for ISO 27001. |
| Structural Integrity | Tool logs a “Yes” for the question “Is the fence secure?”. | Shake the fence. Physical infrastructure cannot be audited via an API or a survey. |
| Monitoring Coverage | Tool verifies that “CCTV is Online” via a ping. | Verify the Blind Spots. A camera that is “Online” but pointed at the floor provides zero security value. |
| Zone Isolation | Platform records the server room as a “Location.” | Check the ceiling. Are there gaps above the suspended tiles that allow an intruder to climb into the server room? |
| Maintenance | Tool sets an automated reminder for “Annual Review.” | Check the Actual Repairs. If the latch on the main gate has been broken for 3 weeks, the “review” is a failure. |
About the author
