Key takeaways
- Control who can enter secure areas.
- Controlling entry ensures only authorised people reach secure areas.
- Start here: use badges, keys or codes to control entry.
Purpose
Control who can enter secure areas.
Requirement
Requirement summarySecure areas shall be protected by appropriate entry controls and access points.
Why it matters
Controlling entry ensures only authorised people reach secure areas.
How to implement
- Use badges, keys or codes to control entry.
- Register and escort visitors.
- Review physical access lists regularly.
- Remove access promptly when people leave.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for entering buildings and handling visitors.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.2 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Visitor sign-in records showing visitors were logged and escorted.
- A list of who has keys or access badges, with approvals.
- Proof leavers' badges were switched off.
Things you should be able to show or explain
- Be able to show that entry is controlled and staff challenge strangers.
How much to show: 10 or so visitor entries and a handful of leavers' badges.
Common mistakes
- Leavers' badges still working.
- Visitors not signed in.
- Visitor logs not kept.
- Former staff badges still working.
- Tip: Badge access with visitor logs is the norm.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.2 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.2?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for entering buildings and handling visitors…