---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.7.1"
title: "Physical security perimeters"
theme: Physical
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts: [Protect]
operational_capabilities: [Physical_security]
security_domains: [Protection]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---
## 7.1 Physical security perimeters

### Control
Security perimeters should be defined and used to protect areas that contain information and other associated assets.

  

### Purpose
To prevent unauthorized physical access, damage and interference to the organization’s information and other associated assets.

  

### Guidance

  

The following guidelines should be considered and implemented where appropriate for physical security perimeters:

  

a\) defining security perimeters and the siting and strength of each of the perimeters in accordance with the information security requirements related to the assets within the perimeter;

  

b\) having physically sound perimeters for a building or site containing information processing facilities (i.e. there should be no gaps in the perimeter or areas where a break-in can easily occur). The exterior roofs, walls, ceilings and flooring of the sit e should be of solid construction and all external doors should be suitably protected against unauthorized access with control mechanisms (e.g. bars, alarms, locks). Doors and windows should be locked when unattended and external protection should be considered for windows, particularly at ground level; ventilation points should also be considered;

  

c\) alarming, monitoring and testing all fire doors on a security perimeter in conjunction with the walls to establish the required level of resistance in accordance with suitable standards. They should operate in a failsafe manner.

  

### Other information
Physical protection can be achieved by creating one or more physical barriers around the organization’s premises and information processing facilities.

A secure area can be a lockable office or several rooms surrounded by a continuous internal physical security barrier. Additional barriers and perimeters to control physical access can be necessary between areas with different security requirements inside the security perimeter. The organization should consider having physical security measures that can be strengthened during increased threat situations.