Why it matters
Higher-sensitivity areas (a data center, a comms room) need rules beyond general office access.
How a self-led small team implements it
Most small SaaS businesses can mark this not applicable if they don't operate a secure area at all — state why.
What auditors expect to see
Secure area access rules, or applicability justification.
Track A.7.6 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS