Zoning is a security control to separate physical areas with different security levels. Zones with higher security levels can be secured by more controls. The facility manager of a conference center is responsible for security. What combination of business functions should be combined into one security zone?

The principle of physical security zoning is to group areas with similar security requirements and access levels. A lobby and a public restaurant are both public-facing areas, designed for open access by visitors, clients, and the general public. They share a similar, low-security profile where the primary controls are focused on reception and general monitoring. Combining them into a single "public" or "unrestricted" zone is a logical and efficient application of the zoning principle, as it effectively isolates these open areas from more sensitive, restricted parts of the facility.

A. A boardroom requires high confidentiality and restricted access, which is a much higher security level than a general office space.
B. A computer room is a critical, high-security area, demanding far more stringent environmental and access controls than a typical storage facility.
D. Human Resource rooms contain sensitive personal data requiring strict access control, a significantly higher security level than general-purpose meeting rooms.

1. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Clause 7.2 Physical entry: This control's objective is to ensure only authorized individuals get physical access. The implementation guidance advises creating physical security perimeters to protect areas. It states, "The design of physical security perimeters should take into account... the separation of publicly accessible areas (e.g. reception area) from internal areas." This directly supports separating public zones (Lobby, Restaurant) from internal zones (Offices, HR rooms, Boardroom).

2. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Chapter 13, Section 13.1, Physical Security: This chapter, common in university information security curricula, discusses physical facility design. It outlines the need to establish outer and inner perimeters, separating publicly accessible areas from work areas and restricted areas. The text explains that areas like lobbies should be in an outer perimeter, while sensitive areas like data centers or HR offices require placement within more secure inner perimeters. This aligns with not combining public and restricted-function rooms.