Measure · ISO 27001 and other standards
Control access to secure areas
Decide which rooms need protection and who may enter them. Use the existing building plan and your current key or access-card administration.
Reuse existing records
Add secure areas and visitor routes to the existing building plan. Maintain access rights in the current key or access-card system and repairs in the usual facilities ticket, rather than creating additional lists.
What to do
- 1
Define areas and boundaries
Mark the rooms needing protection on the building plan and record why. Check with the building operator whether doors, windows and shared entrances adequately secure the boundary.
- 2
Set access and visitor rules
Decide who receives keys or access cards and who escorts visitors. Include approval and revocation in the existing procedures for joiners, role changes and leavers.
- 3
Check the usual route
Walk a normal visitor or delivery route and check that people remain within the intended areas. Fix open doors or incorrect permissions through normal operations and update the plan after building changes.
Worked example
Example for a rented office
The meeting room and equipment room need different access rules.
- Meeting room
- DecisionThe host collects visitors at reception.
- EvidenceVisitor procedure in the existing site documentation.
- Equipment room
- DecisionOnly the named operations roles receive access.
- EvidenceExisting key list or access-card permission.
Record the result
- Existing building plan with the selected secure areas.
- Current access rights and, where needed, a ticket showing that a weakness was fixed.
Common implementation mistakes
The door remains open all day
Check actual use even when the plan and access rule are correct.
Access remains after someone leaves
Include keys and access cards in the existing leaver procedure.
Reuse the implementation across requirements
The references below show which requirements the measure contributes to.
View controls and standards
- A.7.1 · Physische SicherheitsperimeterGerman guide
The building plan identifies security perimeters and their physical boundaries.
- A.7.2 · Physischer ZutrittGerman guide
Access rights, visitor escorts and revocation determine who may cross those boundaries.
TISAX · 3.1.1
VDA ISA 6.0.3 · Partial overlap
The plan, access rules and walkthrough support site assessment. Other requirements and the assessment scope need separate evaluation.
Reference
Resources for your next step
- Assess the protection needs of affected assets
Establish the consequences of unauthorised access or an outage for the area being assessed.
- Assess risks with the risk matrix
Compare identified weaknesses and determine the order in which to treat them.