A secure area is only secure if behaviour inside it is strictly controlled. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in biometrics, man-traps, and heavy vault doors, only to allow staff and contractors to wander around server rooms unmonitored, take photos of server racks on personal smartphones, eat lunch over open hardware, or leave access doors propped open for convenience. Authorised access gets someone through the front door, but it does not remove risk.
ISO 27001:2022 includes Annex A 7.6 to ensure your organisation applies specific operational controls to how people work inside designated secure areas. This control replaces former 2013 requirements (11.1.5) and updates expectations for personal mobile devices, camera phones, lone working, and emergency egress procedures.
Quick Summary: What ISO 27001 Annex A 7.6 Requires
At a practical level, Annex A 7.6 is about managing human behavior and operational tools inside high-risk physical spaces. It does not mean treating your engineering team with suspicion; it expects clear, repeatable rules that protect core assets from accidental damage, unauthorized recording, and casual observation. Here is what you need to do in plain English:
- Define Permitted Activities: Explicitly state what work is allowed inside secure areas (e.g., server rooms, archive vaults) and share rules on a need-to-know basis.
- Restrict Mobile & Recording Devices: Prohibit or tightly control smartphones, smartwatches, cameras, and recording gear inside high-security zones.
- Prohibit Food, Drink & Smoking: Block consumables completely inside technical rooms to prevent accidental spills and hardware contamination.
- Manage Lone Working & Supervision: Enforce supervision or dual-custody rules for external contractors and high-risk maintenance tasks.
- Secure Unoccupied Secure Areas: Ensure doors automatically lock and alarmed doors engage the moment a secure zone is left unattended.
- Align Safety with Security: Ensure emergency exits, fire suppression overrides, and safety procedures are clear, unobstructed, and compliant.
Why Authorised Access Alone Is a Major Physical Risk
Secure areas house your most critical information assets—including core servers, main network switches, primary backup media, and confidential archives. When staff or third-party visitors operate inside these spaces without clear operational boundaries, familiar habits quickly lead to costly mistakes or silent security leaks.
Ignoring secure working controls inside secure areas exposes your business to severe hazards:
- Accidental Liquid Spills and Contamination: Coffee, water, or food crumbs dropped directly onto exposed server blades, causing short circuits or thermal failure.
- Unauthorized Photo and Video Recording: Staff or visitors snapping photos of server configurations, serial tags, or cabling maps that expose internal architecture (Annex A 7.12).
- Propped-Open Security Doors: Employees wedging open heavy vault or server room doors during maintenance, bypassing physical perimeter controls completely (Annex A 7.5).
- Unmonitored Third-Party Contractor Access: Maintenance engineers or HVAC technicians working alone in server rooms making unapproved cabling changes (Annex A 7.13).
My 8 Step Plan to Implement Annex A 7.6 Fast
You do not need an overly intrusive security police force inside your facility to satisfy an ISO 27001 auditor. Here is my pragmatic, 8-step plan to establish an audit-ready secure working environment.
1. Clearly Define Secure Area Boundaries and Rules
Explicitly designate which physical zones are classified as “Secure Areas” and document working rules for each:
- Identify server rooms, core communications closets, tape backup vaults, and confidential document archives.
- Publish clear “Rules of Working” signs at entry points detailing permitted activities and prohibited items.
- Keep detailed layout plans and access lists on a need-to-know basis to prevent public reconnaissance.
2. Restrict Personal Mobile Devices and Recording Gear
Modern smartphones, smartwatches, and tablets carry high-definition cameras and recording capabilities that threaten confidentiality:
- Prohibit personal smartphones, smartwatches, and digital cameras inside high-security zones (or require them to be stored in entry lockers).
- Implement a formal “Permit to Record” approval process for maintenance work requiring photographic evidence.
- Enforce strict penalties for unauthorized audio or visual recording inside restricted facilities.
3. Ban Consumables and Hazardous Materials
Physical contamination is a primary cause of non-malicious hardware downtime:
- Enforce a strict zero-tolerance ban on food, drinks, liquids, and smoking/vaping materials inside all secure areas.
- Prohibit storing combustible materials (such as empty cardboard shipping boxes, paper reams, or packing foam) inside server rooms.
- Provide designated staging zones outside secure areas for unpacking new hardware before installation.
4. Manage Lone Working and Contractor Supervision
Working alone in high-risk physical spaces increases both safety risks and unmonitored security exposure:
- Require internal staff escorts for all third-party maintenance contractors working inside secure areas (Annex A 7.13).
- Enforce dual-custody or two-person rules for high-risk physical tasks (such as destroying backup media or moving core servers).
- Install CCTV physical monitoring (Annex A 7.4) across entryways and main aisles inside secure rooms to maintain an audit trail.
5. Lock and Secure Unoccupied Areas Automatically
A secure area must return to a fully locked state the instant personnel step away:
- Equip all secure area access doors with automatic door-closers and heavy-duty electric strikes.
- Configure door-ajar alarms to sound locally and alert security leads if a door is held or propped open for longer than 30 seconds.
- Conduct routine out-of-hours physical audits to verify that unoccupied secure rooms remain locked.
6. Align Physical Security with Life Safety Requirements
Physical security controls must never trap personnel or impede emergency evacuation during a fire or disaster:
- Ensure emergency exit doors unlock automatically upon activation of fire alarm systems or power loss (fail-safe).
- Install manual emergency break-glass door release buttons on the inside of secure exits, position them clearly, and inspect them regularly.
- Display clear, illuminated emergency egress signs and ensure evacuation paths remain completely unobstructed by boxes or equipment.
7. Enforce Clean Workstation Rules Inside Secure Zones
If staff maintain permanent or temporary workstations inside secure areas, apply clear desk discipline (Annex A 7.7):
- Prohibit leaving sensitive paper documents, backup tapes, or access badges sitting on open workbenches unattended.
- Require staff to lock administrative terminals (`Win + L`) whenever stepping away from server room consoles, even for a minute.
- Store tools, diagnostic cables, and spare hardware inside locked cabinets when not in active use (Annex A 7.10).
8. Conduct Routine Working Practice Audits
Behavioral controls degrade quietly over time as familiarity breeds carelessness. Maintain operational discipline:
- Schedule monthly walk-through inspections to observe working practices, door states, and cleanliness inside secure zones.
- Review CCTV footage periodically to audit contractor activities and verify compliance with mobile device restrictions.
- Feed physical working audit findings directly into your annual ISMS management review.
Common Implementation Pitfalls and How to Fix Them
When preparing clients for ISO 27001 audits, I frequently spot the same working in secure area mistakes. Here are the main traps and how to solve them:
- Problem: Fire Doors Propped Open with Wooden Wedges for Airflow or Fast Access
Ninja Solution: Remove all physical door wedges, install automated door-ajar alarms, and adjust climate cooling systems (Annex A 7.11). - Problem: Empty Cardboard Hardware Boxes Stacked Inside Server Rooms
Ninja Solution: Ban all cardboard and packing materials from server rooms to eliminate fire hazards and dust contamination. - Problem: Unescorted Contractors Left Alone in Tape Vaults or Communications Closets
Ninja Solution: Enforce mandatory staff escorts and log contractor entry/exit times in a central facility logbook. - Problem: Emergency Exit Doors Locked from the Inside Blocking Fire Evacuation
Ninja Solution: Install push-bar exit hardware connected to automatic fire alarm overrides to ensure fail-safe life safety compliance.
The ISO 27001 Ninja Bottom Line
ISO 27001 Annex A 7.6 is about controlling human behaviour where your most high-value assets live. Access badges get people through the door, but enforced operational rules ensure they behave safely once they are inside.
By defining permitted activities, restricting mobile recording devices, banning food and drink, supervising contractors, enforcing self-closing door locks, aligning safety with emergency egress, and conducting routine physical checks, you eliminate accidental downtime, control insider risks, and satisfy your ISO 27001 auditor with complete confidence.