The purpose of control 7.2 Physical entry of ISO/IEC 27001 is to ensure only authorized access to, the organization's information and other associated assets occur. Which action below does NOT fulfill this purpose?

The primary purpose of ISO/IEC 27001:2022 Annex A control 7.2 is to ensure that only authorized personnel are granted access to secure areas. This is achieved by implementing entry controls at defined physical access points. While verifying equipment containing storage media is a valid security practice, it is not the direct purpose of control 7.2. This action is more closely related to asset management, preventing unauthorized removal of assets, or controlling data transfer via physical media, which are addressed by other controls such as 7.10 (Storage media) and 5.14 (Information transfer). Control 7.2 is fundamentally about authenticating and authorizing people, not inspecting the items they carry.

B. Using appropriate entry controls: This is the core requirement of control 7.2, which explicitly states that secure areas "shall be protected by appropriate entry controls."
C. Implementing access points: Establishing defined access points (e.g., doors, gates) is a foundational prerequisite for applying entry controls and managing physical access effectively.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Control 7.2.

Content: The control is titled "Physical entry" and its objective is stated as: "Secure areas shall be protected by appropriate entry controls to ensure that only authorized personnel are allowed access." This text confirms that the focus is on controlling personnel access.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Guidance on information security controls.

Reference: Section 7.2, "Physical entry".

Content: The implementation guidance for this control suggests measures like reception areas, physical access control systems, and instructing personnel on entry procedures. The guidance does not mention the verification of equipment as a primary function of this control, reinforcing that its purpose is to manage the entry of individuals.

3. Calder, A., & Watkins, S. (2020). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page Publishers.

Reference: Chapter 14, Section on A.11.1.2 Physical Entry Controls (corresponds to the previous version of the standard, but the principle remains identical to 7.2 in the 2022 version).

Content: The text explains that physical entry controls are about ensuring only authorized personnel are allowed access, typically through mechanisms like a staffed reception, access card systems, or other forms of identity verification for people entering a secure area. This academic guide aligns the control's purpose with managing personnel access, not equipment verification.