Operations, logging and vulnerability ยท question family
Physical security: the clause the question tests
Who can walk up to the equipment that holds the customer's data, and how that is controlled.
How the customer usually asks it
example"Describe the physical security controls at the data centres that host our data."
Anchor clauses
1 framework| Framework | Anchor clause |
|---|---|
| ISO/IEC 27001:2022 | 7.1 Physical security perimeters |
Every framework that anchors this family is listed here; a register shows the ones ticked for the customer.
Evidence expected
The physical security standard for offices and hosting sites, and for hosted services the provider's attestation covering its data centres.
The clauses, with what an assessor asks for
ISO 27001 7.1 Physical security perimetersDefine and use security perimeters to protect areas holding information and assets.
Evidence an assessor expects: Perimeter design; Access point controls; Visitor management; Surveillance records
Where answers usually fall short: Outdated floor plans; Inconsistent access log retention
Source: ISO/IEC 27001:2022
Where answers usually fall short: Outdated floor plans; Inconsistent access log retention
Source: ISO/IEC 27001:2022