A.7.3 Physical
Securing offices, rooms and facilities
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (25)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PE-18mostlyaligns with — Both controls address the physical placement and visibility of system components to reduce exposure to unauthorized observation or access.
- PE-3mostlyaligns with — Both controls require physical barriers and procedures that restrict unauthorized entry to areas containing sensitive assets or operations.
- PE-3mostlycovers — A.7.3's objective of preventing unauthorized physical access, damage, and interference to offices/rooms/facilities is addressed by the bulk of PE-3's enforcement, verification, ingress/egress controls, and area restrictions, but PE-3's audit-log maintenance requirement sits outside A.7.3's stated scope.
- PE-18partialcovers — A.7.3's broad physical-protection objective for offices/rooms/facilities addresses a slice of PE-18's siting requirements (minimizing unauthorized-access opportunity and some damage vectors), but leaves the bulk of PE-18's specific component-location tactics and hazard-parameter tailoring uncovered.
- PE-19partialaligns with — Both controls consider countermeasures against emanations that could disclose sensitive information from within a facility.
- PE-2partialaligns with — Both controls establish who is authorized to enter specific physical areas that house sensitive processing activities.
- PE-2partialcovers — A.7.3's requirement to prevent unauthorized physical access to offices/rooms/facilities is largely satisfied by PE-2's full process of authorizing, credentialing, reviewing, and removing individuals from the access list; residual exists because A.7.3 also addresses damage and interference beyond just access authorization.
- PE-5partialaligns with — Both controls limit the ability of unauthorized individuals to view or access information displayed or processed by equipment in physical spaces.
- PE-19covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PE-5covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Aligned NIST CSF 2.0 outcomes (9)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-06mostlyaligns with — By restricting public access to critical facilities and limiting visibility of sensitive operations, the ISO guidance implements the CSF requirement to manage and enforce physical access commensurate with risk.
- PR.IR-02mostlyaligns with — The ISO control's focus on siting and configuring physical spaces to shield critical assets from unauthorized observation or access directly supports the CSF outcome of protecting technology assets from environmental threats.
- ID.AM-05partialaligns with — The control implicitly prioritizes physical protection for assets based on their criticality by siting confidential processing facilities away from public areas.
- PR.IR-01partialaligns with — Physical layout and shielding measures reduce the likelihood of unauthorized logical access by limiting opportunities for observation or proximity-based attacks.
- ID.AM-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.AA-06implements — A.7.3 directly operationalizes physical access management, monitoring and enforcement for facilities and assets, which is exactly the outcome named in PR.AA-06
- PR.IR-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.IR-02implements — A.7.3 directly operationalizes physical protection of facilities and assets against environmental threats (damage/interference), which sits squarely inside the PR.IR domain even though the CSF outcome does not name physical security explicitly
Related weaknesses / CWE (7)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1263prevents — Requires securing offices, rooms and facilities to restrict physical access to areas containing sensitive information.
- CWE-1278mitigates — Securing rooms and facilities reduces opportunities for physical IC imaging attacks.
- CWE-1300mitigates — Securing rooms and facilities can shield equipment from side-channel probing.
- CWE-200prevents — Physical concealment and restricted availability of directories and maps limit the exposure of sensitive information about facility locations and processing activities to unauthorized observers.
- CWE-552mitigates — By siting critical facilities away from public areas and avoiding visible or audible disclosure of confidential activities, the control reduces the chance that an attacker can discover or reach sensitive resources that should not be exposed to external parties.
Mitigated MITRE ATT&CK techniques (57)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
T1001.002←MT1003.003→PT1006←MT1011.001←PT1036←MT1036.005←MT1036.008←MT1040←MT1052←M →PT1052.001→PT1055←MT1055.003←MT1055.009←MT1055.013←MT1055.015←MT1078←PT1091←MT1110.001→PT1123←M →PT1127←MT1133←MT1200←M →MT1205←MT1207←PT1213←M →PT1213.001←MT1213.002←MT1219.003←M →PT1535←MT1537←MT1542←MT1550←MT1550.004←FT1557.004←MT1571←PT1572←PT1578.002←PT1578.003←MT1578.004←PT1591→PT1591.001→PT1599←MT1669←P →PT1688←M
Why these map — AI rationale (under review)
- T1003.003prevents — A.7.3's physical siting, unobtrusiveness, visibility/audibility shielding and directory-hiding measures stop some physical or insider paths to domain controllers and NTDS.dit (or backups) but leave the dominant remote/admin-credential, Volume Shadow Copy, ntdsutil, and secretsdump paths untouched.
- T1052prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls stop many insider or visitor opportunities to introduce or remove a physical medium from a facility, but do not reach the technique's core (user-introduced removable media on an already-compromised air-gapped host) nor block all exfiltration paths once media leaves the facility.
- T1052.001prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls prevent an adversary from easily reaching or introducing a USB device into the target facility or air-gapped system, stopping the technique at its physical-entry prerequisite; residual exists because authorized insiders can still introduce or use USB devices inside the secured perimeter.
- T1110.001prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and non-disclosure of facility directories can prevent remote password guessing against on-premises management services by denying the adversary the network reachability or knowledge of targets needed to even begin the technique, but this leaves the bulk of the class (cloud, SaaS, federated, wireless, and externally exposed services) untouched.
- T1123prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls stop an adversary from physically reaching or observing the target devices in the facility, but do nothing to stop malware/scripts already inside from using OS APIs to capture audio from those same devices.
- T1200detects — A.7.3's physical-site protections (siting, unobtrusive design, visibility/audibility shielding, restricted directories) can surface anomalous hardware additions in secured facilities, but this is limited to the physical-entry slice of T1200 and does not address post-introduction abuse or additions outside protected offices/rooms.
- T1200prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls directly stop most unauthorized introduction of hardware devices into offices/rooms/facilities, with only a bounded remainder (e.g. authorized insiders or social-engineering delivery) left unaddressed.
- T1213prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and non-disclosure of facility directories directly prevent public or unauthorized physical access to on-premises information repositories and the sensitive data (diagrams, docs, credentials, PII) they contain, but this leaves the dominant digital/cloud misconfiguration vectors (overly-broad IAM, public SaaS shares, exposed RDS/Elasticsearch) untouched.
- T1219.003prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls can stop an adversary from physically reaching and installing KVM hardware in offices/rooms, but this leaves the post-compromise software-bypass and remote-install vectors (and non-facility systems) untouched.
- T1591prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding, and non-disclosure of directories/maps directly stops some physical and on-site information exposure vectors for org details, but the technique's dominant online, social-media, phishing, and public-website paths remain untouched.
- T1591.001prevents — A.7.3's guidance (no obvious signs, no readily available directories/maps identifying confidential facilities) directly stops some public/online exposure vectors for physical location details that the technique relies on, but leaves open elicitation, social media, and non-facility data sources named in the T1591.001 prose.
- T1669prevents — A.7.3's physical siting, unobtrusive design, visibility/audibility shielding and directory controls can stop an adversary from physically approaching or discovering target Wi-Fi networks in offices/facilities (the proximity-dependent vector), but do not address remote third-party dual-homed bridging, valid account use on secured networks or post-connection activities.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.