Physical security is the foundation that all digital security controls rest on. An organization with perfect MFA, flawless vulnerability management, and a mature SIEM can have its entire security posture bypassed by an adversary who walks into an unlocked server room and plugs in a rogue device. Physical controls are not a secondary concern — they are the layer that makes every other layer meaningful.
Domain 7 is the smallest numbered domain in Annex A but covers controls of substantial consequence. Control 7.14 (secure disposal) is one of the most commonly under-evidenced controls in Indonesian organizations — devices disposed of through informal channels or without documented secure wiping create data exposure that persists after the equipment leaves the organization. Control 7.4 (physical security monitoring), introduced in 2022, formalizes the requirement for continuous or risk-based monitoring of physical premises — a control that many organizations have implemented informally through CCTV but have never made a documented ISMS activity.
This article covers all 14 physical controls with full implementation guidance, the scope applicability matrix for organizations of different types (particularly for cloud-native and hybrid organizations navigating which controls apply to them), and a pre-audit physical security checklist organized for efficient evidence gathering.
Domain 7 Sub-Group Structure
The 14 physical controls are organized into 7 sub-groups following the physical security lifecycle — from defining boundaries to disposing of equipment at end-of-life:
| Sub-group | Controls | Coverage |
| Physical perimeters and entry (7.1–7.3) | 7.1–7.3 | Define and secure physical boundaries around areas containing information assets. Control who can enter and establish secure area working rules. |
| Physical security monitoring (7.4) | 7.4 ★ | NEW in 2022 — Monitor premises for unauthorized physical access using CCTV, alarms, or security personnel. The new control reflecting the convergence of physical and information security. |
| Environmental protections (7.5–7.6) | 7.5–7.6 | Protect against physical and environmental threats (fire, flood, power failure) and define rules for working in secure areas. |
| Clear desk and screen (7.7) | 7.7 | Require a clear desk policy for papers and removable media and a clear screen policy for information processing facilities when unattended. |
| Equipment security (7.8–7.10) | 7.8–7.10 | Site and protect equipment, secure assets used off-premises, and manage storage media — covering hardware lifecycle from siting through off-site use. |
| Infrastructure and utilities (7.11–7.12) | 7.11–7.12 | Protect supporting utilities (power, cooling, water) and cabling infrastructure from damage, interference, or interception. |
| Equipment maintenance and disposal (7.13–7.14) | 7.13–7.14 | Maintain equipment correctly and ensure that all data is securely destroyed before equipment is disposed of or repurposed. One of the most commonly under-evidenced controls. |
Complete Control Reference: All 14 Physical Controls
The complete reference table below covers all 14 controls. Each entry includes requirement summary, implementation guidance, evidence required, common gap, and Indonesian regulatory context. Control 7.4 is marked ★ as the one new control introduced in the 2022 revision:
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
| ||||||
|
| 7.4 PHYSICAL SECURITY MONITORING — WHY IT MATTERS | Control 7.4 is new in ISO 27001:2022 and represents the formalization of a control many organizations already have in place (CCTV) but have never documented as an ISMS control. The key requirements auditors look for: (1) monitoring covers all entry points to secure areas — not just the main entrance, (2) recordings are retained for a defined period with configuration evidence, (3) a response procedure exists for when monitoring detects an anomaly, and (4) monitoring is reviewed, not just passively recorded. An organization with CCTV that cannot answer 'what is your retention period?' or 'who reviews the footage and how often?' does not satisfy 7.4 despite having hardware in place. |
Scope Applicability: Which Controls Apply to Your Organization
Domain 7 is the Annex A domain where scope decisions vary most significantly between organizations. A cloud-native technology company with no owned premises has a fundamentally different physical security profile than a financial institution with a regulated data center. The matrix below maps Domain 7 applicability for four common Indonesian organization scenarios:
| Organization type | Applicable controls | Typically excluded | Notes |
| Organization with own office and server room | 7.1 (perimeters), 7.2 (entry controls), 7.3 (securing offices), 7.4 (monitoring — NEW), 7.5 (environmental threats), 7.6 (working in secure areas), 7.7 (clear desk/screen), 7.8 (equipment siting), 7.9 (off-premises assets), 7.10 (storage media), 7.11 (supporting utilities), 7.12 (cabling), 7.13 (maintenance), 7.14 (secure disposal) | None typically excluded — all 14 controls apply | Full Domain 7 scope. Server room physical security is heavily tested at Stage 2. Access logs, CCTV coverage, environmental monitoring, and UPS test records are commonly requested evidence. |
| Fully cloud-native / fully remote organization (no own premises) | 7.7 (clear desk/screen — for remote workers), 7.9 (off-premises assets — laptops, mobile), 7.10 (storage media — portable devices), 7.13 (maintenance — end-user devices), 7.14 (secure disposal — laptops) | 7.1–7.6 (no physical premises or secure areas in scope). 7.8 (equipment siting applies to remote workers but may be partially scoped). 7.11–7.12 (no owned infrastructure). | Must justify exclusions with specific rationale: 'Not applicable — the organization has no physical premises or owned server infrastructure; all processing occurs in cloud facilities managed by certified providers.' Physical security of cloud facilities is addressed through supplier security (5.23) rather than Domain 7. |
| Office-based with co-location / cloud servers (no owned data center) | 7.1–7.9 for office environment. 7.10, 7.13, 7.14 for end-user devices. Physical security of the co-lo facility addressed through supplier security (5.22, 5.23) rather than Domain 7 controls. | 7.11–7.12 typically excluded or addressed through supplier security for the co-lo facility. | The most common scenario for Indonesian technology companies. The co-location provider's ISO 27001 or SOC 2 report can be used as evidence of physical security at the data center level, supplemented by the organization's own office physical controls. |
| Financial institution with regulated data center requirements | All 14 controls, with enhanced implementation standards for 7.1–7.5 driven by POJK IT governance requirements and BI payment system physical security standards. | None | POJK 11/2022 and BI payment system regulations specify physical security requirements that exceed ISO 27001 minimums. Indonesian financial institutions should implement to the higher regulatory standard and treat ISO 27001 as a compliance framework within that context. |
| Justifying physical control exclusions in the SoA: For cloud-native organizations excluding controls 7.1–7.6, the exclusion justification must be specific and complete. Generic justifications like 'not applicable — we use cloud' are not sufficient. The required justification format: 'Not applicable — [organization] has no owned or leased physical premises containing information processing facilities. All information processing occurs within facilities operated by [cloud provider name], whose physical security is governed by [the provider's ISO 27001 certification / SOC 2 Type II report]. Physical security obligations for these facilities are addressed through supplier security controls (5.22, 5.23) rather than direct implementation of Domain 7 controls.' This level of specificity satisfies auditors and regulators. |
Physical Security in Indonesian Context
Environmental threats specific to Indonesia
Control 7.5 requires organizations to assess and mitigate physical and environmental threats relevant to their location. Indonesian organizations face a distinct set of environmental risks that must be explicitly addressed:
- Flooding: Jakarta's regular flooding risk — particularly for ground-floor server rooms and basement infrastructure — requires elevation above floor level, water detection sensors, and emergency response procedures. Many Jakarta data breaches have resulted from flood damage to inadequately protected infrastructure rather than cyber attack.
- Earthquake risk: Organizations in high-seismic zones (parts of Java, Sumatra, Sulawesi) should assess equipment anchoring, rack stability, and recovery procedures in earthquake scenarios.
- Power instability: Indonesia's power grid reliability varies significantly by region. Surabaya, Medan, and outer island organizations face higher power instability risk than Jakarta. UPS sizing must account for typical outage duration in the specific location, not generic standards.
- Humidity and heat: Indonesian climate creates specific HVAC requirements for server rooms. Server room temperature and humidity monitoring with automated alerts is essential — overheating and corrosion from humidity are genuine equipment failure risks in the Indonesian climate.
Physical disposal and e-waste regulations
Control 7.14 (secure disposal) intersects with Indonesian e-waste regulations. Equipment disposal must comply with Government Regulation No. 101/2014 on Hazardous and Toxic Waste Management for electronic equipment. The practical implication for ISMS implementation: disposal vendors for IT equipment must be authorized for e-waste handling under Indonesian regulation — not just capable of data destruction. Retain both the secure destruction certificate (evidence for 7.14 and UU PDP) and the e-waste disposal certificate (evidence for environmental compliance).
POJK IT facility standards
For Indonesian financial institutions, POJK 11/2022 specifies physical security requirements for IT facilities that set a higher standard than ISO 27001's principle-based requirements. Key POJK-specific physical requirements include: dedicated secure rooms for core banking infrastructure, access control with logging requirements for IT facilities, environmental monitoring with defined response procedures, and physical security requirements for branch IT equipment. ISO 27001 Domain 7 implementation in a POJK-regulated environment should be calibrated to the POJK standard — ISO 27001 certification demonstrates the management system, while POJK compliance ensures the technical specifics are met.
Common Domain 7 Gaps
Secure disposal without evidence
The most common and consequential Domain 7 gap: devices are disposed of — sometimes appropriately — but no disposal records are retained. Three to five years after disposal, an auditor asks for evidence that the laptops decommissioned in 2022 were securely wiped. No records exist. The evidence of secure disposal is the certificate — either from the in-house secure wipe procedure (recording the device serial number, wipe method, operator, and date) or from the third-party destruction vendor. Without this record, the control cannot be verified regardless of what was actually done. Start retaining disposal records immediately and retroactively for any equipment still within the documentation retention period.
Physical access not reviewed quarterly
The quarterly access review that ISMS teams apply to digital systems is rarely applied to physical access control systems. The result: former employees who left 12 months ago still have active physical access cards. Long-departed contractors whose card was 'returned' but not deactivated in the access system. Accounts in the access control software that no longer correspond to anyone in the organization. Physical access review must be synchronized with the digital access review cycle — the same process, applied to both access control systems.
Cloud-native organizations over-scoping Domain 7
The reverse problem also occurs: cloud-native organizations that include all 14 Domain 7 controls in their SoA as 'applicable' because they have office space, without assessing which controls genuinely apply to their physical footprint. A 20-person software company in a co-working space with no owned server infrastructure does not have the same physical security profile as a 500-person financial institution. Over-including controls without genuine implementation creates SoA entries that auditors will probe — and cannot be evidenced. Scope Domain 7 honestly against the actual physical environment, justify exclusions specifically, and implement the applicable controls well.
Pre-Audit Physical Security Checklist
Use this checklist in the 6 weeks before a Stage 2 or surveillance audit to verify that physical security evidence is current, accessible, and complete:
| Perimeters and entry (7.1–7.2) |
☐ Physical perimeter diagram documented and current ☐ All secure area boundaries physically sound — no gaps via false ceilings, shared walls, or service corridors ☐ Access control readers installed at server room and other secure area entrances ☐ Access control logs available — minimum 90 days of entry records retained ☐ Unauthorized persons cannot access secure areas without escort ☐ Physical access rights reviewed quarterly — same cadence as digital access review ☐ Former employees' physical access cards deactivated within 4 hours of departure |
| Monitoring and environment (7.4 ★, 7.5) |
☐ CCTV or equivalent monitoring deployed at all secure area entrances ☐ CCTV recording retention meets defined policy (minimum 30 days) ☐ Physical security monitoring response procedure defined and assigned ☐ Environmental threat assessment documented for this location ☐ Flooding risk addressed (elevated server room or water detection sensors) — relevant for Jakarta ☐ Fire suppression installed and tested in server room ☐ Temperature and humidity monitoring active in server room with alerts configured |
| Equipment and media (7.8–7.10) |
☐ Server racks not visible from public areas or through windows ☐ Network equipment in locked cabinets ☐ Laptop encryption enabled for all devices used off-premises ☐ Off-premises device loss/theft reporting procedure defined (1-hour target) ☐ Removable media register maintained — all USB drives, external drives documented ☐ Removable media containing sensitive/personal data encrypted |
| Infrastructure (7.11–7.12) |
☐ UPS deployed for critical systems — capacity verified against actual load ☐ Generator present for extended outages — last test within 12 months ☐ Redundant ISP connection (or documented risk acceptance if single ISP) ☐ Cabling diagram current — all server room connections documented ☐ Cables labelled — what connects to what is verifiable without 'tribal knowledge' ☐ Power and data cables separated in runs to minimize interference |
| Maintenance and disposal (7.13–7.14) |
☐ Equipment maintenance schedule documented per asset type ☐ Maintenance records retained (service reports, invoices) ☐ Data removed from devices before external maintenance ☐ Secure disposal procedure documented with NIST SP 800-88 or equivalent method ☐ Asset disposal register maintained — every disposed device recorded with disposal method ☐ Secure destruction certificates obtained and retained for all media containing personal or confidential data ☐ SSD disposal uses secure erase command or physical destruction — not format-only |
| Bitlion physical controls tracking: Bitlion's GRC platform tracks physical security controls within the same ISMS evidence framework as technical and governance controls. Physical access review records, equipment maintenance schedules, disposal certificates, and environmental monitoring test records are uploaded against their corresponding Annex A control and clause references. The evidence currency dashboard flags physical security controls where evidence has lapsed beyond the defined review period — preventing the common situation where physical controls are implemented but evidence is not maintained between audits. |