ISO 27001 A.7.3: Securing Offices, Rooms and Facilities

Quick Reference (60 Seconds)

The Bottom Line: A.7.1 draws the perimeter and A.7.2 controls the doors. A.7.3 is about how the rooms behind those doors are designed: where your critical rooms sit, whether anything advertises them, whether people outside can see or hear what happens inside, and whether your own documents and maps tell an outsider where to go. Most of it costs little, and much of it is decided when you choose or fit out an office.

What the Control Asks For

In short

Annex A 7.3 asks organizations to design and apply physical security for offices, rooms and facilities.

Do you need this control?

A.7.3 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Include it if you have offices, rooms or facilities in scope. A fully remote organisation with no premises in scope can exclude it.

What ISO 27002:2022 Adds

ISO 27002 7.3 (paraphrased) gives four points to consider:

• (a) Siting: place critical facilities where the public cannot get to them.
• (b) Unobtrusive premises: where it applies, buildings should give little indication of their purpose, with no obvious signs, inside or outside, that identify information processing activity.
• (c) Not visible or audible: configure facilities so confidential information and activities cannot be seen or heard from outside, and consider electromagnetic shielding where appropriate.
• (d) Location information: do not make directories, internal phone books or online maps that show where confidential processing facilities are readily available to unauthorised people.

That is the whole of the 27002 guidance for 7.3. Locks and entry, monitoring, environmental protection, clear desk and equipment placement are real needs, but each has its own control (see the next table). Auditors testing A.7.3 look at siting, signage, visibility, sound and what your documents and maps reveal.

What Belongs to Sibling Controls

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): physical security for offices, rooms and facilities is designed and implemented.
• Should (27002 guidance): the four points above, applied in proportion to your risks. You decide which apply and how far.

Common Misinterpretations

Why Securing Offices and Rooms Matters

The Business Risk Narrative

Physical attacks and insider snooping usually start with reconnaissance, and offices leak a lot of it. A sign on the comms room door tells a tailgater where to go. A building directory or online map listing "XYZ Network Operations Centre, 4th floor" does the same for anyone. Glass-walled meeting rooms show whiteboards, screens and visitor lists to the corridor or the street. Thin partitions let a visitor waiting in reception hear a pricing call. Office-tour videos and job adverts show floor layouts and room names.

None of this needs a break-in: it gives an attacker the map and sometimes the information itself. A.7.3 closes those gaps by design, usually at low cost, and is easiest to get right when you choose or fit out premises.

Indian Context

• Shared buildings are the norm. IT parks, SEZs and co-working spaces have common lobbies, tenant boards, shared corridors and landlord-run reception. Choose suites and rooms with this in mind, and agree with the landlord what the tenant board, signage and published floor plans show.
• Fire and building rules come first. The National Building Code 2016, Part 4 and the state fire NOC govern exits, signage and partitions. Making a room unobtrusive or sound-proof must not block an exit, remove required signs or add unapproved materials. Fit-out changes in leased premises usually need landlord and sometimes fire-authority approval.
• DPDP Act 2023: reasonable security safeguards (s.8(5)) include physical ones for rooms where personal data is handled, for example HR and records rooms. If confidential personal data is overheard or seen and misused, that may be a personal data breach under s.8(6) once the Rules apply.
• Sector rules: RBI (Cyber Security Framework for banks, Master Direction on IT Governance 2023), SEBI CSCRF (2024) and IRDAI's 2023 guidelines expect physical security for data centres and sensitive processing areas of regulated entities.
• Client contracts: global clients of IT/ITeS delivery centres often specify secure floors, no visibility from common areas, and no published layouts.

Scope and Applicability

What the Control Covers

• Siting of critical rooms and facilities (server and comms rooms, records rooms, HR and finance areas, board rooms, secure delivery floors)
• Signage and indications of purpose, inside and outside the building
• Visibility and audibility of confidential work from outside the room or building, and electromagnetic emanations where relevant
• Location information: directories, phone lists, floor plans, evacuation plans, online maps, listings and published photos or videos

What It Does NOT Cover

See "What Belongs to Sibling Controls" above: entry (A.7.2), monitoring (A.7.4), environment (A.7.5, A.7.11), behaviour in secure areas (A.7.6), clear desk and screen (A.7.7), equipment placement (A.7.8).

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

The Four Measures in Practice

(a) Site Critical Facilities Away from Public Access

• Put server, comms and records rooms in interior spaces, away from the reception, lobby, shared corridors, washrooms and goods lifts, and not on the ground floor next to the street.
• Do not route visitors past critical rooms on the way to meeting rooms. Put client meeting rooms and interview rooms near reception, so visitors never enter the working floor.
• In shared buildings, prefer suites where the comms cupboard is inside your demised area rather than off a common corridor. If the riser cupboard is shared, lock your rack.
• Consider environmental hazards when siting (no critical room below water tanks, toilets or kitchens, or in a basement prone to flooding); A.7.5 covers this in depth.
• When choosing premises or planning a fit-out, write these siting rules into the fit-out brief: they are expensive to change later.

(b) Keep Premises and Rooms Unobtrusive

• Use neutral room numbers instead of function names on sensitive rooms. "Room 4.12" tells a visitor nothing; "Server Room" or "Payroll" tells them where to go.
• Keep legally required signs: exit signs, fire equipment, gas-suppression warnings and electrical hazard signs. Pair a neutral room number with the mandated hazard sign.
• Check outside indications: building tenant boards, lobby screens, branded data-centre buildings, delivery labels and vehicle livery. Show the company name if you must, not what the floor does.
• For dedicated facilities (a data centre or disaster recovery site), keep external branding minimal where the business allows.

(c) Stop Confidential Work Being Seen or Heard from Outside

Visibility

• Apply frosted film or blinds to glass walls of board, HR, finance and interview rooms, at least across the band where screens and whiteboards sit.
• Face whiteboards and wall screens away from windows and glass doors. Check from the street and from neighbouring buildings at night, when lit rooms are most visible.
• Make sure confidential documents and screens cannot be read from reception or waiting areas (A.7.7 and A.7.8 handle the desk and the screen; A.7.3 handles the room).

Audibility

• Specify sound-rated partitions (a higher STC rating) and doors with seals for rooms where confidential conversations happen. Partitions should run to the true ceiling, or the ceiling void will carry sound.
• Use sound masking in open areas next to meeting rooms, and provide phone booths so confidential calls are not taken at desks or in lobbies.
• Test it: have someone talk at normal volume in the room while you listen from the corridor and the next room.

Electromagnetic emanations

• 27002 says to consider shielding where appropriate. For most commercial organisations a risk assessment will show it is not needed.
• Where your threat model includes well-resourced attackers (defence, government classified work, high-value research), options include separation distance from public areas, shielded rooms and equipment certified for low emanation. Follow your client's or government's requirements; do not improvise.

(d) Keep Location Information Out of Unauthorised Hands

• Internal directories and phone lists: do not list room locations of critical facilities in documents open to all visitors or contractors.
• Floor plans: restrict detailed plans that label critical rooms to people who need them (facilities, security, fire officers). Keep the plans the fire authority requires, but posted evacuation plans can show routes and exits without naming the function of each room.
• Online maps and listings: check Google Maps and other map listings, building websites and co-working directories for entries that name sensitive facilities. Correct or remove them.
• Photos and videos: review office-tour videos, recruitment posts and social media for visible room names, screens, whiteboards and badge designs.
• Job adverts and tenders: avoid stating where facilities are ("our NOC on the 4th floor of Building B").
• Review all of the above at least once a year and after any move or fit-out.

Room-by-Room Design Standard

Implementation Roadmap

Phase 1, Review (Weeks 1–2)

• List rooms and facilities with what they hold (from the asset inventory, A.5.9, and classification, A.5.12).
• Walk the premises as a visitor, and at night from outside. Record function signs, visible screens and whiteboards, and audible rooms.
• Search public sources: map listings, the website, social media, job adverts, building directories.

Phase 2, Quick Fixes (Weeks 2–4)

• Replace function signs with neutral room numbers (keeping required safety signs).
• Apply frosting or blinds; turn whiteboards and screens away from glass.
• Correct public listings; restrict floor plans; review posted evacuation plans.

Phase 3, Design Changes (as needed)

• Relocate critical rooms or meeting rooms where siting is poor; agree changes with the landlord and, where needed, the fire authority.
• Upgrade partitions or add sound masking for confidential rooms.
• Write the siting and design rules into the fit-out brief for future moves.

Phase 4, Sustain

• Annual facility exposure review (the toolkit has a checklist).
• Review after any move, fit-out, new building or public campaign that shows the office.

Office, Room and Facility Security Policy (Template)

Office, Room and Facility Security Policy: [Organisation] (A.7.3)

1. Siting. Critical facilities (server and comms rooms, records stores, [others]) shall be
   located in interior areas away from public access and public routes. New premises and
   fit-outs shall follow the siting rules in [fit-out standard].

2. Signage. Sensitive rooms shall carry neutral room identifiers, not function names.
   Legally required safety and hazard signs shall always be displayed.

3. Visibility. Confidential information and activity shall not be visible from outside the
   room or building: glass walls of [board, HR, finance, interview] rooms shall be frosted
   or fitted with blinds, and screens and whiteboards shall not face glass or windows.

4. Audibility. Rooms used for confidential discussion shall have sound-rated partitions
   and sealed doors, or sound masking, so that speech cannot be understood from outside.

5. Emanations. The need for electromagnetic shielding shall be assessed for [facilities]
   where the risk assessment or a client requires it.

6. Location information. Directories, phone lists, floor plans and online listings shall
   not identify the location of critical facilities to unauthorised people. Detailed plans
   are restricted to [roles].

7. Review. Facilities shall complete a facility exposure review annually and after any
   move or fit-out, and track actions to closure.

Owner: [Facilities / Workplace Lead]   Approved by: [Top management]   Review: annual

Risk Assessment and Treatment

Audit and Compliance Checklist

Metrics and KPIs

Common Pitfalls

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: SaaS Company in a Co-Working Building (Gurugram)

Situation. A 60-person SaaS company used a glass-walled meeting room next to the co-working lobby for interviews and product reviews. A candidate left waiting alone in that room could see the product roadmap on the whiteboard and pricing on a wall screen, and photographed both. The company's suite was also listed on the building's lobby screen as "Product and Data Team, Floor 6, Server Room 6B".

What changed.

1. Interviews moved to a small room by the suite entrance; candidates are never left alone.
2. Frosted film on the glass meeting rooms across the screen and whiteboard band; whiteboards turned to face solid walls.
3. Signs changed to neutral room numbers; the landlord's lobby screen now shows only the company name.
4. An annual exposure review now covers the suite walk, the landlord's displays, the map listing and recruitment photos.

Lesson. Nothing was broken into. The room's design and signage handed over the information.

Illustrative Scenario 2: Regional Office of a Financial Services Firm (Pune)

Situation. An internal audit found the regional server room opened directly off the customer waiting hall, with a "Server Room: Authorised Staff Only" sign. The posted evacuation plan labelled it too, and HR held disciplinary meetings in a room whose thin partition backed onto the waiting hall.

What changed.

1. The comms rack was moved to an interior room behind the staff-only area. The old room became storage with no IT equipment.
2. Neutral room numbers replaced function signs; required electrical and suppression warnings were kept.
3. The evacuation plan was redrawn to show exits and routes only; the detailed plan is held by Facilities and given to the fire officer on request.
4. HR meetings moved to a room with a sound-rated partition; sound masking was added in the waiting hall.

Lesson. Siting and signage choices made at fit-out created the exposure. They were cheaper to fix than the controls that would otherwise be needed to compensate.

Maturity Model

Figure · Tiers

Maturity levels for securing offices, rooms and facilities

Target L3 for certification.

Key Takeaways

• A.7.3 is about designing offices, rooms and facilities: siting, unobtrusiveness, visibility and sound, and location information.
• Keep critical rooms away from public routes and plan it at fit-out.
• Swap function signs for neutral room numbers, but keep every legally required safety sign.
• Stop confidential work being seen or heard: frosting, orientation, sound-rated rooms, masking.
• Treat floor plans, directories, map listings and office photos as sensitive.
• Leave entry, monitoring, environment and clear desk to their own controls, and cross-reference them.

Multi-Framework Mapping

India Regulatory Context

FAQ

Is A.7.3 mandatory?

No Annex A control is mandatory in itself. If your risk assessment selects A.7.3 (normal when you have offices in scope), record it in your Statement of Applicability and implement it. A fully remote organisation can exclude it with a justification.

Is clear desk part of A.7.3?

No. Clear desk and clear screen are A.7.7. A.7.3 makes sure the room itself does not expose information; A.7.7 covers what people leave on desks and screens.

Do we have to take down all signs?

No. Keep exit, fire, gas-suppression and electrical hazard signs, which the law and your fire NOC require. Replace signs that name a room's function with neutral room numbers.

Do we need electromagnetic shielding?

Probably not. 27002 asks you to consider it where appropriate. Record the decision in your risk assessment. Shielding is mainly relevant to defence, government classified and some high-value research work, or where a client requires it.

We are in a co-working space. What can we do?

Choose a suite where critical equipment is inside your own space, use the private rooms for confidential meetings, frost any glass you control, and agree with the operator what the lobby screens, directories and booking apps show about you.

Our fire evacuation plan has to show the layout. Is that a conflict?

Keep the plan the fire authority requires. Posted plans can show routes, exits and assembly points without naming the function of each room; keep the detailed labelled plan with Facilities.

What will the auditor do for A.7.3?

Usually walk the site: look for function signs, check what is visible through glass and from outside, listen at confidential rooms, and ask how floor plans and public listings are controlled. They will also ask for your policy and the last exposure review.

How does A.7.3 differ from A.7.1 and A.7.2?

A.7.1 sets the perimeter, A.7.2 controls entry through it, and A.7.3 designs the offices, rooms and facilities inside so they do not attract attention or leak information.

References and Further Reading

Primary standards

• ISO/IEC 27001:2022: Annex A control 7.3.
• ISO/IEC 27002:2022: 7.3, with related 7.1, 7.2, 7.4–7.8.
• ISO/IEC 27701:2025: privacy information management.

Supporting frameworks

• NIST SP 800-53 Rev 5: PE-3, PE-5, PE-18, PE-19.
• NIST CSF 2.0: PR.AA-06.
• PCI DSS v4.0.1: Requirement 9.
• SOC 2 (2017 TSC, revised points of focus 2022): CC6.4.
• COBIT 2019: DSS05.05.

Indian law and regulation

• Digital Personal Data Protection Act, 2023: s.8(5), s.8(6).
• Information Technology Act, 2000: s.43A.
• National Building Code of India 2016: Part 4, Fire and Life Safety.
• RBI, SEBI CSCRF (2024) and IRDAI (2023) cyber security directions for regulated entities.

Singahi resources: the A.7.3 toolkit and related guides for A.7.1 Physical security perimeters, A.7.2 Physical entry, A.7.6 Working in secure areas, A.7.7 Clear desk and clear screen and A.7.8 Equipment siting and protection.