ISO 27001 Annex A 7.1 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 7.1 Physical security perimeter

1. Physical Security Perimeter Definition Verified

Verification Criteria: The organisation has clearly defined and documented the physical boundaries of its security perimeters, including all sites, data centres, and office spaces within the ISMS scope.

Required Evidence: Site plans or floor maps showing the physical security boundaries and the location of entry/exit points.

Pass/Fail Test: If the organisation cannot produce a map or diagram that clearly demarcates where the “secure zone” begins and ends, mark as Non-Compliant.

2. External Barrier Structural Integrity Confirmed

Verification Criteria: External walls, fences, and gates are constructed to a standard that prevents unauthorised physical entry and shows no signs of structural bypass vulnerability.

Required Evidence: Physical inspection of external perimeters and maintenance logs for gates/fences.

Pass/Fail Test: If any external wall or fence has a gap larger than 10cm or shows signs of unrepaired damage that allows access, mark as Non-Compliant.

3. Controlled Entry Point Implementation Validated

Verification Criteria: All entry points into secure perimeters are protected by a controlled access mechanism (e.g. badge readers, security guards, or PIN pads).

Required Evidence: Physical sighting of access control hardware and a list of all authorised entry points.

Pass/Fail Test: If a secondary fire exit or delivery door is found unlocked and unmonitored during the audit, mark as Non-Compliant.

4. Reception Area Isolation Verified

Verification Criteria: Public-access areas, such as reception or delivery bays, are physically separated from the internal secure perimeters to prevent tailgating or unauthorised wandering.

Required Evidence: Floor plan showing the buffer zone between reception and secure office space; physical verification of the “lock-gate” or turnstile.

Pass/Fail Test: If a visitor can walk from the street into the main office desks without passing through a secondary locked door, mark as Non-Compliant.

5. External Window and Aperture Hardening Confirmed

Verification Criteria: Windows at ground level or accessible heights are fitted with security film, bars, or reinforced glass to prevent forced entry.

Required Evidence: Technical specifications of window glazing or physical sighting of security grilles/bars.

Pass/Fail Test: If ground-floor windows are made of standard non-reinforced glass and lack security sensors, mark as Non-Compliant.

6. Intruder Detection System (IDS) Coverage Validated

Verification Criteria: An active intruder detection system is installed covering all perimeter boundaries, integrated with an alarm that notifies security personnel of a breach.

Required Evidence: IDS configuration report or recent alarm test logs from the monitoring provider.

Pass/Fail Test: If the IDS has not been tested in the last 12 months or if there are “blind spots” in the perimeter coverage, mark as Non-Compliant.

7. CCTV Surveillance Perimeter Coverage Verified

Verification Criteria: CCTV cameras are positioned to monitor the entire perimeter, providing clear visibility of all entry and exit points in various lighting conditions.

Required Evidence: Live CCTV feed inspection and a camera placement map showing overlapping fields of view.

Pass/Fail Test: If CCTV footage at entry points is too low-resolution to identify a human face or is blocked by foliage, mark as Non-Compliant.

8. Signage and Deterrent Visibility Confirmed

Verification Criteria: Clear signage exists to indicate that the area is private property and under constant surveillance, serving as a legal and psychological deterrent.

Required Evidence: Physical sighting of “Private Property,” “Authorised Access Only,” and “CCTV in Operation” signs.

Pass/Fail Test: If the perimeter lacks signage informing individuals they are entering a secure zone, mark as Non-Compliant.

9. Internal Zone Segregation Integrity Validated

Verification Criteria: High-risk internal areas (e.g. server rooms, archive stores) have their own sub-perimeters that require a higher level of access authorisation than the general office.

Required Evidence: Site map showing “Zones” and physical verification of floor-to-ceiling partitions for server rooms.

Pass/Fail Test: If server racks are located in an open-plan office area without a dedicated physical room/cage, mark as Non-Compliant.

10. Physical Security Review and Maintenance Logs Present

Verification Criteria: The organisation performs regular inspections of the physical perimeter to identify and fix wear and tear or security weaknesses.

Required Evidence: Quarterly physical security inspection reports and evidence of completed repair tickets for doors or locks.

Pass/Fail Test: If there is no record of a physical security walk-around being conducted in the current audit year, mark as Non-Compliant.

About the author