What it asks for. This control expects security perimeters to be defined and used to protect areas that contain information and other associated assets. The aim is to prevent unauthorised physical access to, damage to and interference with the organisation's information and assets.
In practice. Good practice means identifying sensitive areas, such as server rooms, offices with confidential information and delivery areas, and defining perimeters with suitable walls, doors, locks and alarms. The strength of protection matches the value of the assets inside. Auditors expect site plans or descriptions of secure areas, inspection of physical measures and evidence that perimeters are maintained.
Common gaps. Typical gaps are perimeters weakened by propped doors or shared building access, and secure areas that are not clearly defined. Perimeters of shared offices and co-working spaces are often assumed to be someone else's responsibility, and alarms or locks are not tested.