When you start ISO 27001 on ComplyJet, the physical security controls may begin in a disabled state. This is expected, so that organizations without an office are not asked for evidence that does not apply to them.

If you do have an office and want it in your ISMS scope, follow the steps below. If you are fully remote, see Marking Physical Security Controls Out of Scope in SOA instead.

In the left-hand navigation, go to Compliance → Frameworks and click ISO 27001.

On the ISO 27001 page, click the Controls tab, then open the Excluded tab. You should see the physical security controls listed here, such as Physical entry, Physical security monitoring, and Securing offices, rooms and facilities.

Nothing in the Excluded tab? Then the physical security controls are already active and you do not need to do anything.

Tick the checkbox at the top of the table to select all the physical security controls, then click Activate.

Refresh the Frameworks page. Your ISO 27001 framework now includes the physical security controls.

Along with the controls, you may need to activate a document that is disabled by default.

Go to Tests in the left-hand navigation and open the Excluded tab. Search for visitor. You should find a document called Office visitor log.

Nothing found? Then the document is already active and you do not need to do anything.

If it appears in the Excluded tab, select it and click Activate.

Go back to your Tasks page & select ISO 27001 framework. If there are any open tasks - complete them.