ISO 27001 Annex A physical controls
ISO 27001:2022 Annex A 7 holds 14 physical controls: protecting premises and secure areas, keeping desks and screens clear, looking after equipment on and off site, handling storage media, and protecting utilities and cabling. Physical security monitoring (7.4) is new in 2022. A remote company can exclude some, but not the ones that follow its laptops.
The requirement in plain English
The physical theme protects the places and things that hold information. In plain terms the 14 controls fall into five groups.
| Group | Controls | What it covers |
|---|---|---|
| Premises and secure areas | 7.1–7.6 | Defined perimeters, controlled entry, secured offices and rooms, monitoring for unauthorised entry, protection from fire, flood and similar threats, and rules for working in secure areas |
| Desks and screens | 7.7 | Clearing papers and media away and locking screens when unattended |
| Equipment | 7.8, 7.9, 7.13, 7.14 | Siting and protecting equipment, protecting it off site, maintaining it, and wiping or destroying it before disposal or reuse |
| Storage media | 7.10 | Managing removable and other media through use, transport and disposal |
| Utilities and cabling | 7.11–7.12 | Protecting against power and utility failures, and protecting cables |
The control new in 2022 is physical security monitoring (ISO 27001:2022 Annex A 7.4): premises are watched for unauthorised physical access, by alarms, cameras, guards or similar, in proportion to the risk.
As with every Annex A control, your risk treatment decides whether each applies, and the Statement of Applicability records the reason either way. A reason must match reality. “No office” excludes perimeter and entry controls; it does not exclude a laptop.
This is guidance to help you understand the requirement, not legal advice.
What good looks like
A 15-person software company has no office: staff work from home and meet in a coworking space twice a month. Production runs on a public cloud.
Its Statement of Applicability excludes the premises controls 7.1 to 7.6 and the utilities and cabling controls, each with the same reason: no premises of its own, and data centre protection covered by the cloud provider. The provider’s certificate and assurance report are reviewed every year under the cloud services control (ISO 27001:2022 Annex A 5.23), and that review is the evidence behind the exclusions.
It keeps the controls that follow people and devices. Screens lock after five minutes, enforced by device management, and the home working rules ask people to keep work papers out of sight and to work where screens cannot be overlooked (ISO 27001:2022 Annex A 7.7). Laptops are encrypted, never left in cars, and carried as hand luggage (ISO 27001:2022 Annex A 7.9). USB storage is blocked by default, and the rare exception is logged (ISO 27001:2022 Annex A 7.10). Returned laptops are wiped with a recorded method before reissue or recycling, and the recycler supplies a certificate (ISO 27001:2022 Annex A 7.14).
The coworking space’s own access control is noted as a supplier arrangement, and staff never leave equipment there overnight.
A company with an office would add a visitor log reviewed monthly, an alarm or camera covering the entry for 7.4, and a quarterly clear desk walk-round.
Evidence an auditor expects
- Statement of Applicability entries for theme 7: each exclusion with a reason the auditor can check against the scope.
- Cloud provider assurance: the certificate or report you rely on, and when you last reviewed it.
- Device configuration: screen lock, encryption and media controls, often shown from a device management console.
- Disposal records: wiping or destruction certificates for a sample of retired devices.
- Clear desk and screen checks: for offices, inspection records; for home workers, the rules and how people learned them.
- Visitor and access logs: where you have premises, a sample period reviewed by someone.
Common mistakes
Excluding the whole theme
“Fully remote, not applicable” across all 14 controls is the classic overreach. Equipment off site, storage media, secure disposal and clear screens still apply to home workers. Exclude only the controls your reason really covers, such as premises, utilities and cabling you do not have.
Relying on a provider without evidence
Exclusions justified by “the cloud provider handles it” need the provider’s assurance on file and a record of your review. Without it, the auditor has nothing to test the reason against.
Disposal without proof
Old laptops go to a recycler with no record of what was wiped. Keep a disposal record per device, with the method and a certificate where a third party destroys it.
Monitoring confused with logging
The new monitoring control is about people entering premises, not system logs. If you have an office, show how unauthorised entry would be noticed.
Home working rules nobody knows
The remote working policy covers physical risks at home, but staff have never read it. Tie it to the people controls (ISO 27001:2022 Annex A 6.7) and to the device rules (ISO 27001:2022 Annex A 8.1), and include it in awareness training.
How Sted helps
- For the ISO 27001 Annex A physical controls Sted’s knowledge base carries the Physical Security Policy (POL-PHS) with its Physical Security Configuration Record (REC-PSC), Physical Security Review Record (REC-PSR) and Physical Access and Visitor Log Review Record (REC-PAVR), the Clear Desk and Clear Screen Policy (POL-CDS) with its Clear Desk and Clear Screen Inspection Record (REC-CDSIR), the Removable Media Policy (POL-RMM), and the Asset Disposal Record (REC-ADR) under the Asset Management Policy (POL-ASM).
- Records are part of the Full Management System plan.
- You can exclude a control with a coded reason and justification and record its implementation status.
- An excluded control needs one of nine coded reasons, Other needs a written justification, and an excluded control counts as decided for audit readiness; a document’s controls cannot be decided while a newer draft of it is in progress.
- 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
Sted records your exclusions with their reasons and holds inspection and disposal records. Whether an exclusion holds up is for your auditor to judge.
Related guides and terms
- The Statement of Applicability: recording the reason behind each exclusion.
- Annex A people controls: the remote working rules that go with these controls.
- Annex A technological controls: device protection, encryption and deletion.
- How to write a Statement of Applicability: writing exclusions an auditor accepts.
- The Statement of Applicability in Sted: the coded exclusion reasons, including no physical premises.
Frequently asked questions
Does a fully remote company need the ISO 27001 physical controls?
Some of them. Controls about premises you do not have can be excluded with that reason, but clear screens, equipment used off-site, storage media and secure disposal still apply to laptops and home offices. Expect to keep four to six of the 14, depending on how you treat equipment siting and maintenance at home.
Do I need to audit my cloud provider’s data centre?
No. You rely on the provider’s own assurance, such as its ISO 27001 certificate or SOC 2 report, and review it under the cloud services control. Record which physical controls the provider covers so your exclusions have a reason.