#iso27001/2013
# ISO 27001 A 11 Physical and environmental security
A.11.1 | Secure areas ||
--- | :----------------------- | :--- |
Objective: To prevent unauthorized physical access, damage and interference to the organization’s information and information processing facilities. |||
A.11.1.1 | Physical security perimeter | Security perimeters shall be defined and used to protect areas that contain either sensitive or critical information and information processing facilities. |
A.11.1.2 | Physical entry controls | Secure areas shall be protected by appropriate entry controls to ensure that only authorized personnel are allowed access. |
A.11.1.3 | Securing offices, rooms and facilities | Physical security for offices, rooms and facilities shall be designed and applied. |
A.11.1.4 | Protecting against external and environmental threats | Physical protection against natural disasters, malicious attack or accidents shall be designed and applied. |
A.11.1.5 | Working in secure areas | Procedures for working in secure areas shall be designed and applied. |
A.11.1.6 | Delivery and loading areas | Access points such as delivery and loading areas and other points where unauthorized persons could enter the premises shall be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. |

A.11.2 | Equipment ||
--- | :----------------------- | :--- |
Objective: To prevent loss, damage, theft or compromise of assets and interruption to the organization’s operations. |||
A.11.2.1 | Equipment siting and protection | Equipment shall be sited and protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access. |
A.11.2.2 | Supporting utilities | Equipment shall be protected from power failures and other disruptions caused by failures in supporting utilities. |
A.11.2.3 | Cabling security | Power and telecommunications cabling carrying data or supporting information services shall be protected from interception, interference or damage. |
A.11.2.4 | Equipment maintenance | Equipment shall be correctly maintained to ensure its continued availability and integrity. |
A.11.2.5 | Removal of assets | Equipment, information or software shall not be taken off-site without prior authorization. |
A.11.2.6 | Security of equipment and assets off-premises | Security shall be applied to off-site assets taking into account the different risks of working outside the organization’s premises. |
A.11.2.7 | Secure disposal or re-use of equipment | All items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. |
A.11.2.8 | Unattended user equipment | Users shall ensure that unattended equipment has appropriate protection. |
A.11.2.9 | Clear desk and clear screen policy | A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities shall be adopted. |