ISO 27001 Annex : A.11 Physical and Environmental Security

ISO 27001 Annex : A.11 Physical and Environmental Security in this article explain Secure areas, Physical Security Perimeter and Physical Entry Controls. 

A.11.1 Secure areas

Its objective is to avoid unauthorized physical access, damage and interference with the organization’s information and information processing facilities.

A.11.1.1 Physical Security Perimeter

Control- Security perimeters should be established in order to secure areas that contain either sensitive or confidential information and information processing facilities.

Implementation Guidance- When appropriate, for physical security perimeters, the following guidelines should be considered and implemented:

1. Security perimeters should be established and the location and intensity of each perimeter should depend on the security requirements of the assets inside the perimeter and on the results of the risk assessment;
2. The building or facility perimeters should be physically secure (i.e. there are no perimeter gaps or places where a break-in can easily occur); the site’s exterior buildings, walls, and floors should be securely built and all external doors should be properly secured against unauthorized controlled entry (e.g. bars, alarms, locks); Doors and windows should be locked when the windows are unattended and external security, especially at ground level, should be considered;
3. There should be a manned reception area or other methods of physical access control for the site or building and only authorized personnel can access to sites and buildings.
4. Physical barriers to prevent unauthorized physical access and environmental contamination should be built, wherever applicable;
5. All fire doors should be alerted, monitored and tested alongside walls in order to determine the level of resistance needed in accordance with appropriate state, national and international standards; should act in a failsafe fashion in accordance with the Local Code;
6. Appropriate intrusion detection systems, according to the national, regional, or international standards shall be installed and tested regularly for the coverage of all exterior doors and accessible windows. Unoccupied areas should be alarmed at all times.
7. Organization-controlled information management facilities should be segregated physically from those operated by outside parties.

“ When you gambled with safety, you bet your life”

Other Information- The physical protection of the organization’s premises and information processing facilities can be achieved by creating one or several physical barriers. Additional protection is offered by using multiple barriers when a single barrier failure does not immediately affect security.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A protected space may be a closed office or multiple rooms that are enclosed with an internal physical protection restriction. Additional barriers and perimeters for the physical access control between areas with various security requirements within the safety perimeter may be necessary. And in the case of buildings with assets for multiple organizations, special attention to be given to physical security of entry.

The use of physical controls especially for the safe areas, as set out in the risk assessment, needs to be adjusted to the technical and economic circumstances of the organization.

The Organization wishes that its information to remain within the CIA triads. They also ensure that the physical security controls are properly and efficiently implemented to protect the confidentiality, authenticity and/or integrity of the organization’s information and information processing facilities. The physical and environmental protection of the company is covered in Annex 11 of ISO 27002 . This famous certification of lead auditor and lead implementer covers all the annexes to the security of information by implementing appropriate access controls to ensure authorized access to protect the organization. Infosavvy , a Mumbai-based institute, offers certifications and training for multiple-domain-like management of information security, cybersecurity, and many others, including the IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). This certification covers several audits to keep an organization safe from the intended destructor. Infosavvy will help you to understand and identify the full extent of the physical and environmental security of your organization that is necessary to protect the operations of your organization from attacks. We have trained trainers who have ample know-how and experience in order to make sure that the information security is effectively handled. The applicant will, therefore, gain the skills needed to conduct the ISMS audit using commonly agreed audit concepts, procedures and techniques

Also Read : ISO 27001 Annex : A.10 Cryptography

A.11.1.2 Physical Entry Controls

Control- Appropriate access controls should protect places to ensure that only authorized employees are allowed access.

Implementation Guidance- The following points should be taken into consideration:

1. Visitors should be registered on the date and time of their entry and departure and should supervise all visitors, without prior approval of their access; Access should be given for certain approved purposes only, and guidelines should be provided regarding safety and emergency procedures specifications for the region. Visitors’ identity should be authorized using a suitable means;
2. Access should be limited to areas where information is processed or stored by means of suitable access controls, for example, the introduction of a two-factor authentication system, such as an access card and a secret PIN;
3. Securely maintaining and monitoring of a physical logbook or electronic audit trail of all access records;
4. Every employee, contractor and an external person should wear some visible identification and should inform security personnel immediately if they meet unescorted people and anyone who does not have visible ID;
5. Limited access to secure areas or confidential information processing facilities should only be allowed to the employee who is external support services when necessary; access authority and monitoring should be provided;
6. Access privileges to protected areas should be periodically reviewed, updated and, revoked. where necessary.

Questions related to this topic

1. What are the types of perimeter barriers?
2. What are perimeter controls?
3. What are the 5 physical security controls required for information security?
4. What are the three routes possible for data interception According to NIST?
5. What is ISO 27001 Annex : A.11 Physical and Environmental Security?
6. what are the controls of ISO 27001 Annex : A.11 Physical and Environmental Security?

---