ISO 27001 and your lobby: what Annex A 7.2 physical entry means for visitor management

What changed in ISO 27001:2022, and is your certificate on it?

ISO published the third edition of ISO/IEC 27001 in October 2022, with a climate action amendment in 2024 (ISO). Annex A now holds 93 controls in four themes, down from 114 in 14 clauses: 11 are new, 24 merged from older ones and 58 updated (DQS). The themes are organisational (37 controls), people (8), physical (14) and technological (34) (TCSA).

The transition is over. Under IAF MD 26:2023, issued by the International Accreditation Forum, certification bodies had to start all initial and recertification audits on the 2022 version by 30 April 2024, and every certification based on ISO/IEC 27001:2013 had to expire or be withdrawn at the end of the transition period on 31 October 2025 (IAF MD 26, INAB, SGS). The IAF ceased operations on 1 January 2026, when its work passed to the Global Accreditation Cooperation Incorporated, known as Global ACI (IAF). As of October 2026, any valid accredited certificate should name ISO/IEC 27001:2022.

For the lobby, the change that matters is the renumbering (NQA mapping, which uses the 2017 European edition with the same numbering as 2013):

What Annex A 7.2 physical entry actually asks

The control is one sentence. In our words: protect secure areas with appropriate entry controls and access points, so only authorised people get in. It prescribes no turnstile, card reader or type of register. Your risk assessment decides what “appropriate” means for each area, and you show that it works. Three things follow:

• It applies to points of entry, not just server rooms. Consultants describe 7.1 as the perimeter and 7.2 as the controlled points where people cross it: badge systems, visitor management and delivery areas (TCSA). Reception is usually the first.
• The loading bay is now in the same control. With the 2013 delivery and loading areas control merged into 7.2, the goods gate, courier counter and vendors’ back entrance are tested alongside the front desk.
• Your boundary may not be the building’s. In tech parks and multi-tenant towers the landlord usually runs the lobby, turnstiles and lifts. Consultants advise treating those as an outer ring you verify but do not own, with your enforceable boundary at your own suite door (TCSA). In co-working, the operator’s reception and member cards are controls you inherit and document.

Smaller organisations can describe how entry is controlled in the Statement of Applicability; mid-sized and larger ones should write a physical security policy (Advisera).

What ISO 27002 7.2 guidance says about visitors

ISO/IEC 27002:2022 is the guidance standard behind Annex A. It cannot be certified against (ISO), but auditors use it to judge whether your control is reasonable. Paraphrased, its 7.2 guidance covers three groups.

Visitors

• Identity: authenticate who the visitor is by an appropriate means.
• Times: record the date and time of entry and departure.
• Purpose: give access only for a specific, authorised purpose, and tell visitors the security rules of the area and the emergency procedures.
• Supervision: supervise all visitors unless an explicit exception has been approved.

General entry controls

• Visible identification: everyone wears visible identification, staff tell security when they see someone unescorted or without it, and badges that tell employees, suppliers and visitors apart are worth considering. Consultants add that a visitor badge should show when it expires (High Table, TCSA).
• Suppliers: supplier staff get access to secure areas only when needed, and that access is authorised and monitored.
• Shared buildings: a building that holds the assets of several organisations needs particular attention to physical access, which describes most Indian tech parks and multi-tenant towers.
• Records: keep a logbook or electronic audit trail of access, and protect it.
• Review: review and update access rights regularly, and take them away when they are no longer needed.

Delivery and loading areas

• Restriction: only identified, authorised people reach delivery areas from outside.
• Separation: keep goods movement apart from people movement; the internal door stays locked while the external door is open.
• Inspection and registration: hold incoming material in the delivery area until it is inspected and registered under your asset procedures, and keep delivery staff inside the delivery zone (TCSA, UpGuard).

Two mistakes recur in published advice. One says ISO 27001 requires ID verification for every visitor; the guidance asks for identity to be authenticated by appropriate means, which is your risk decision. The other quotes a fixed retention period “under ISO 27001”; neither standard sets one.

Related controls auditors test alongside 7.2

An auditor walking your lobby rarely stops at 7.2. These controls come up in the same conversation (titles from NQA).

Logging and privacy catch teams out. A visitor register is personal data, so expect to be asked who can see it and how you would know if someone exported it. In India, 5.34 points to the Digital Personal Data Protection Act 2023 and the Rules notified in November 2025 (PIB). Most duties apply from 13 May 2027 under Rule 1(4), eighteen months after publication (SCC Online); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A proposal to shorten the timeline was floated in January 2026 (Business Standard), but as of 12 October 2026 none had been notified, and S.S. Rana & Co. still gave May 2027 for the core duties. See our guide to the DPDP Act and your visitor register.

What a Stage 2 or surveillance auditor asks for at the lobby

Stage 1 reviews documentation and readiness; Stage 2 tests implementation and normally covers physical entry. Surveillance audits in the next two years cover a rotating sample of Annex A controls, so 7.2 may not be tested every year, and recertification follows in the third (TCSA). When 7.2 is tested, auditors use document review, interviews with reception and security staff, and observation at the entry points (TCSA). Expect requests like these:

1. The visitor or physical security policy, approved, versioned and recently reviewed.
2. All visitor records for a date the auditor picks, with a few traced end to end: approval, pass, escort, exit time.
3. Approval evidence: a record of who approved and when, not “the host said yes on the phone”.
4. Badge or pass control: how badges are issued and returned, and what happens to a lost one.
5. Escort rules, tested by asking a guard what happens when a visitor walks off alone.
6. Contractor inductions and NDAs for contractors on site that day.
7. Who accessed visitor records, and evidence that access is restricted and reviewed.
8. Retention: your stated period for each detail, how it fits the DPDP Rules, and proof that older records are gone.

Auditors may also test whether a recent leaver’s badge still works and check how the delivery area is separated from internal corridors (TCSA).

Common nonconformities at Indian sites

These are the gaps we see most often at Indian offices, campuses and plants.

• Unapproved walk-ins. The guard lets a vendor in because “sir is expecting him”, and the approval is only a phone call or a forwarded WhatsApp message.
• Shared badges. Numbered visitor cards, no record of which went to whom, and nobody counting them at day end.
• Visitor lists not reconciled. The building lobby keeps one record, the tenant a spreadsheet, and they never match.
• No exit times. Visitors leave by the side gate and the “out time” column stays blank.
• Tailgating at turnstiles. A visitor follows a staff member through on one swipe in the morning rush.
• Contractors without induction records. Housekeeping, AMC technicians and project labour on monthly passes, with no signed induction or NDA.
• Open registers. Each visitor can read the names and mobile numbers above their own, also a 5.34 problem.
• Policy and practice disagree. The policy says all visitors are escorted; the guard says only on the server floor. UpGuard names this gap as a common finding.

What your ISO 27001 visitor log should record

For each visit, a log that stands up in an audit records: visitor name and organisation; host, approver and time of approval; purpose and areas allowed; how identity was checked, for the visitor types that need it; badge or pass and its validity; date and time in and out; escort or approved exception; and, for contractors, induction and NDA completed. Keep nothing more: every extra field is personal data to protect and erase under the DPDP Act.

Writing an ISO 27001 visitor policy

A visitor policy for 7.2 can be short. It covers:

• Scope and zones: sites, gates, visitor types, and who may enter which areas.
• Approval: who approves, the backup when the host is away, and walk-ins.
• Identity, badges and escort: when identity is checked, how visitor badges differ, and escort rules.
• Contractors and deliveries: inductions, NDAs and review for long passes; where couriers and goods stop.
• Records: what is recorded, who sees it, how access is logged and how long it is kept.
• Incidents: what a guard does on refusal, tailgating or an unescorted visitor.

The 7.2 evidence pack

ISO 27001 lobby checklist before your next audit

1. Confirm your certificate names ISO/IEC 27001:2022 and your Statement of Applicability cites 7.2, not A.11.1.2.
2. Zone your site and record which entry controls are yours and which the building’s.
3. Approve a visitor policy your guards and reception actually follow.
4. Record identity check, host approval, purpose and times for every visit.
5. Make visitor passes distinct and traceable to one person, with escort rules in writing.
6. Complete contractor inductions and NDAs before first entry.
7. Separate the delivery area and inspect goods before they move inside.
8. Restrict and log access to visitor records, set retention per detail and keep proof of erasure.
9. Rehearse a date sample and close the gaps you find.

Where Orb fits

Orb, our visitor management system, supports your ISO 27001 audit for Annex A 7.2 by producing the visit records and access logs above with each visit.

Questions buyers ask