Measure · ISO 27001 and other standards
Set up and check site protection
Connect room use, local hazards and equipment siting to known working rules and continuous physical access monitoring. Check the actual protection at the site.
Reuse existing records
Use the building plan, zoning concept, existing risks and operational records. The IT and site operations policy remains the leading source; a second site register or a rule file for each room is unnecessary.
What to do
- 1
Clarify room use and required protection
Use the existing zoning plan and information classes. Check public and shared areas and confidential processing. Select rooms and equipment positions that prevent unauthorised access and protect confidential activities from observation or overhearing. Restrict sensitive site and room details to authorised recipients. In the existing site or risk record, note the area, relevant hazard, protection decision and owner.
- 2
Address environmental hazards and equipment siting
Before critical use and at suitable repeat reviews, assess local hazards such as fire, water, heat, dust, vibration or deliberate damage. Involve the necessary specialists and building operator. Implement suitable protection and place equipment according to manufacturer conditions and protection needs. Establish relevant environmental limits, their monitoring and appropriate rules for food, drinks and other damaging influences. Life safety and fire protection remain binding.
- 3
Apply working rules in secure areas
Explain permitted activities, devices brought in and photographic, video and audio recording to all relevant internal and external personnel. Share knowledge of sensitive activities only as needed. Avoid unsupervised work where required for protection and safety. Secure vacant areas and inspect them appropriately; keep necessary emergency instructions accessible. Use existing rules rather than a separate signature list per room.
- 4
Set up continuous detection and response
Establish continuous monitoring for unauthorised entry appropriate to the site, such as staffed guarding, alarms or suitable video systems. Clarify coverage during absence, actual alarm reception, cover and response. Protect monitoring and records from unauthorised access or tampering. Determine necessary data, access and retention with responsible functions under applicable privacy and employment rules.
- 5
Check operation and maintain changes
Test the chosen detection, including alarm routing and response, and inspect required safeguards on site. Follow manufacturer and suitable test conditions. Record area or device, check, date, result, necessary correction and verified closure in the existing record. Repeat suitable checks and reassess changes to threats, rooms or use.
Worked example
A technical room adjoins a public area
Fictional example: A technical room adjoins a shared corridor. A window allows observation; a water pipe runs above equipment.
- Observation and environmental protection
- DecisionThe responsible roles change equipment position and screening. They assess the water risk and implement suitable protection. A suitable alarm is tested through the actually staffed route.
- EvidenceExisting site record with area, hazards, decisions, owners and actual check results.
Record the result
- Existing site or risk record with reasoned protection choices, responsible role and implemented state.
- Known working rules and checked monitoring, alarm routes and resolved defects in existing operational records.
Common implementation mistakes
Only looking at the locked door
Also check observation, overhearing, environmental hazards, safe work and continuous detection of unauthorised entry.
Operating a camera without a response
Check actual alarm reception and an appropriate follow-up route. A recording alone does not contain harm.
Reuse the implementation across requirements
The references below show which requirements the measure contributes to.
View controls and standards
- A.7.3 · Sicherung von Büros, Räumen und EinrichtungenGerman guide
Room use, siting, protection against observation and overhearing, and sensitive location details are determined and checked on site.
- A.7.4 · Physische SicherheitsüberwachungGerman guide
Continuous detection of unauthorised entry, staffed response, protected recording and functional checks are set up in site operations.
- A.7.5 · Schutz vor physischen und umweltbedingten BedrohungenGerman guide
Local physical and environmental hazards lead to professionally selected and checked safeguards; changes are reassessed.
- A.7.6 · Arbeit in SicherheitszonenGerman guide
Working conditions, devices and recording in secure areas are communicated and applied; vacant areas and emergency instructions are included.
- A.7.8 · Platzierung und Schutz von BetriebsmittelnGerman guide
Actual equipment siting considers access, observation, manufacturer conditions and relevant environmental conditions and is checked in practice.
TISAX · 3.1.1
VDA ISA 6.0.3 · Partial overlap
The work supplements zoning and entry procedures with actual protection of rooms and infrastructure and known behaviour rules. Other ISA zoning, visitor and protection-need requirements still require separate checking.
Reference
Templates for your implementation
Template
IT and site operations policy
Bring operational rules together and connect existing inventories, work instructions and recovery plans. Includes explained fields and an editing guide.
Free ZIP · DOCX, ODT and PDF · with editing guidance
Template
Existing information protection rules
One policy for information classes, labelling and handling. With fields and an example classification scheme to adapt to your organisation.
Free ZIP · DOCX, ODT and PDF · with editing instructions
Related resources
Related measure
Clarify boundaries and physical access firstView measureUse the existing zoning plan and key or badge administration.
Kopexa
Maintain site rules in KopexaExplore featureConnect current policy versions to ownership and their next review.