A.7.3 — Are sensitive offices/rooms (server rooms, finance, HR) secured separately from general office space?
Demonstrate that sensitive offices and rooms containing critical systems or confidential information are physically segregated from general office space with independent access control mechanisms and documented authorization processes.
Description
What this control does
This control requires physical separation and independent access restrictions for areas containing sensitive information or critical systems—such as server rooms, data centers, HR offices, and finance departments—from general office areas accessible to all employees. Implementation typically involves dedicated locked doors with separate access control systems (card readers, biometric scanners, or keypads), controlled entry/exit logging, and restricted key/credential distribution. The separation prevents unauthorized internal personnel from gaining casual or opportunistic access to high-value assets, sensitive data, or systems that could be exploited or compromised. This layered physical security approach complements logical access controls and reduces the attack surface by limiting physical proximity to critical resources.
Control objective
What auditing this proves
Demonstrate that sensitive offices and rooms containing critical systems or confidential information are physically segregated from general office space with independent access control mechanisms and documented authorization processes.
Associated risks
Risks this control addresses
- Unauthorized employees gaining physical access to servers or networking equipment to install malicious hardware, exfiltrate data via direct system access, or disrupt services
- Insider threats exploiting unrestricted physical access to HR files containing personally identifiable information (PII), salary data, or disciplinary records for identity theft or blackmail
- Opportunistic theft or tampering of financial records, payment processing terminals, or accounting systems by personnel without legitimate business need
- Visitors, contractors, or cleaning staff inadvertently or intentionally accessing server rooms to steal equipment, copy data from unsecured terminals, or cause physical damage
- Social engineering attacks where attackers tailgate authorized personnel into sensitive areas lacking visible separation or independent entry controls
- Accidental or deliberate disruption of environmental controls (HVAC, fire suppression) in server rooms by unauthorized personnel unfamiliar with critical infrastructure safeguards
- Failure to detect or audit physical access events in sensitive areas, allowing undetected breaches or insufficient forensic evidence during security incidents
Testing procedure
How an auditor verifies this control
- Obtain the organization's facility layout diagrams and identify all areas designated as sensitive (server rooms, data centers, HR offices, finance departments, executive suites, records storage).
- Review the physical access control policy and procedures to verify documented requirements for separate access authorization, credential issuance, and entry restrictions for each sensitive area.
- Conduct a physical walkthrough of general office space and each identified sensitive area to observe physical barriers (walls, locked doors, security doors), access control devices (card readers, biometric scanners, cipher locks), and signage restricting entry.
- Select a sample of 5-10 employees with varying roles and obtain their access control lists from the physical access control system to verify that general employees lack credentials for sensitive areas.
- Review access logs for each sensitive area covering the past 90 days and identify at least 10 entry events to confirm only authorized personnel successfully accessed the space.
- Attempt to physically approach sensitive area entry points to verify that general office circulation paths do not provide direct line-of-sight or casual access without encountering access controls.
- Interview facilities management and at least two department managers (HR, IT, Finance) to confirm processes for requesting, approving, issuing, and revoking access credentials to their respective sensitive areas.
- Verify that visitor and contractor escort policies explicitly require continuous accompaniment in sensitive areas and review visitor logs to confirm compliance with escort requirements.