How to write a physical and environmental security policy

Why physical security still matters

Cloud has not removed the physical layer: offices, devices, server rooms and the people walking through them. A physical and environmental security policy defines how you control access to facilities and protect equipment from theft, tampering and environmental damage — a gap auditors notice even in cloud-native companies.

What to include

Scope — offices, data rooms, equipment, and home-office considerations.
Access control — badges, zones, and least-privilege access to sensitive areas.
Visitors — registration, escorting and access limits.
Equipment — secure storage, cable locks, clear-desk and clear-screen practices.
Environmental controls — power, cooling and fire protection for critical equipment.
Disposal — secure destruction of media and hardware.
Monitoring — CCTV and alarms where appropriate, with privacy considered.

Common mistakes

Assuming "we're cloud" means no physical scope — laptops and offices remain in scope.
No visitor process, an easy audit finding.
No clear-desk/clear-screen practice, leaving data exposed.

Framework alignment

Maps to ISO 27001:2022 Annex A 7.1–7.14 (physical and environmental security), the SOC 2 criteria, and NIST CSF Protect (PR.AA / PR.IR).

Primary sources

ISO/IEC 27001:2022 — Annex A controls 7.1–7.4, physical security perimeters and controls (iso.org/standard/27001).
NIST SP 800-53 Rev. 5 — Physical and Environmental Protection (PE) control family (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final).
ANSSI — recommandations sur la sécurité physique des locaux (ssi.gouv.fr).

Generate it in minutes

See a sample physical security policy or generate yours free.

Frequently asked questions

Does physical security still matter for a cloud-first company?

Yes. Even fully cloud-hosted companies have offices, laptops, and people. Annex A 7 covers physical entry, secure areas, equipment protection, and clear-desk practices. A stolen unlocked laptop or an unescorted visitor can undo strong technical controls, so physical security stays in scope.

What does a clear-desk and clear-screen policy require?

Sensitive papers and removable media are locked away when unattended, and screens are locked or set to auto-lock when a user steps away. Annex A 7.7 names this control because exposed documents and unlocked screens are a simple, common route to data exposure in shared spaces.

How should visitors be handled?

Visitors should be registered, identified, and escorted in secure areas, with access limited to what they need. Annex A 7.2 and 7.3 cover physical entry and securing offices; a visitor log plus escorting gives you both deterrence and an audit trail if something goes wrong.