# ISO/IEC 27001 7.3 — Securing offices, rooms and facilities

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27001_73_29ae9a9987-isoiec-27001-73-securing-offices-rooms-and-facilities
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27001:2022](https://support.icompaas.com/support/solutions/c_gen_iso27001) › [Physical controls](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27001_physicalcontrols)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27001 · Control 7.3 · Priority: high · Component: Physical controls

### What this control covers

Physical security for offices, rooms and facilities shall be designed and implemented.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Securing offices, rooms and facilities.

### Quick checklist

-   Policy — Management / Security
-   Management — Management / Security
-   Physical — Management / Security
-   Security — Management / Security

### Related articles on this site

-   [Ensure ELB uses predefined security policy (ssl)](https://support.icompaas.com/support/solutions/articles/62000219192-ensure-elb-uses-predefined-security-policy-ssl-)
-   [Physical Security](https://support.icompaas.com/support/solutions/articles/62000225136-physical-security)
-   [Security Headers Remediation - Content Security Policy](https://support.icompaas.com/support/solutions/articles/62000226554-security-headers-remediation-content-security-policy)
-   [Security Header Remediation: Referrer-Policy](https://support.icompaas.com/support/solutions/articles/62000226558-security-header-remediation-referrer-policy)