Physical security management
Physical security management protects the people, premises and access a core service needs, and it connects the site controls to the wider security and emergency arrangements.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names physical security management as a supporting discipline; the standard does not define it. For clause 5.8, the contribution is the protection of sites, people and physical assets from harm, intrusion and unauthorized access, and the control of access during an emergency. The resilience question is whether the security arrangements help or hinder the response. A locked gate that no one can open, or an access list that is only on the affected system, can turn a disruption into a crisis.
Why it matters
Physical security and emergency management meet in the first hour. The organization needs to keep unauthorized people out while letting emergency services, staff and contractors in. That requires a degraded-mode access plan and a way to verify identity without the primary system. The discipline also protects the assets identified under asset management. The useful evidence is a tested emergency access route, not only a perimeter control.
What good looks like
Define the access needed by emergency services, staff, contractors and suppliers in a disruption. Record the degraded-mode verification and the person who can authorize access. Test the route with the primary system unavailable. Include the critical sites and the alternate locations. Review the arrangement when a site or a security system changes.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how emergency services get in when the access system is down. A perimeter control plan without a degraded route can delay the response.
- Critical site list The sites a core service depends on, with the security owner
- Emergency access plan How emergency services, staff and contractors enter when systems are down
- Degraded verification How identity is checked without the primary access system, with the test
- Authorization record Who can open a site or grant access in a disruption, with the limits
Where it commonly fails
- Access control depends entirely on a system that the incident may take down.
- No one at the site can authorize emergency access.
- The security plan does not consider staff or contractors arriving outside normal hours.
What to do before the second edition
Test the emergency access route at night with the system off. Record what had to be forced or bypassed. Fix that step.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
← A.15 Information, communications and technologyA.17 Quality management →