7.2 Physical entry

Organizations should control and isolate access points, including delivery sites and loading locations, from information processing facilities to stop unauthorized access. Access to physical areas should be restricted to authorized workers only, and a process for managing access rights should be established. Physical access should be monitored and logged, and authentication mechanisms should be used, such as access cards or biometrics. A reception area should be set up to control access, and personal belongings should be inspected. Personnel should wear visible IDs, and special attention should be given to physical security in buildings containing crucial resources for multiple organizations. Key management processes should also be established.