ISO 27001 Annex A 7.2 Audit Checklist

In this ultimate how to audit guide to ISO 27001 Annex A 7.2 Physical Entry Controls, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.2 Physical Entry Controls Audit Checklist

Auditing ISO 27001 Annex A 7.2 Physical Entry Controls is a rigorous technical assessment of the mechanisms securing physical perimeters and high-security zones. The Primary Implementation Requirement is the enforcement of authenticated, logged entry points, providing the Business Benefit of mitigating unauthorized access risks and ensuring site-wide accountability.

This technical verification tool is designed for lead auditors to establish the integrity of physical access points to secure areas. Use this checklist to validate compliance with ISO 27001 Annex A 7.2 (Physical entry controls) by verifying that access to buildings and rooms is restricted to authorised personnel.

1. Physical Access Policy Formalised and Approved

Verification Criteria: A documented policy exists defining the authorisation levels and entry requirements for different physical zones (e.g. public, office, and high-security areas).

Required Evidence: Formally approved Physical Security Policy with version history and management sign-off.

Pass/Fail Test: If the organisation relies on verbal agreements rather than a documented policy for determining who can enter secure zones, mark as Non-Compliant.

2. Visitor Logging Integrity Verified

Verification Criteria: All visitors are recorded in a log containing date, time of entry/exit, name, organisation, and the identity of the host.

Required Evidence: Physical or electronic visitor register showing complete entries for the previous 90-day period.

Pass/Fail Test: If visitor logs contain significant gaps, missing exit times, or illegible entries, mark as Non-Compliant.

3. Physical Identification and Badge Usage Confirmed

Verification Criteria: All personnel, contractors, and visitors are required to wear visible identification badges that distinguish between different access categories.

Required Evidence: On-site visual verification of staff and visitors wearing badges; badge issuance procedure documentation.

Pass/Fail Test: If personnel are observed inside secure perimeters without visible ID badges, mark as Non-Compliant.