Why it matters
Controls who can actually get into the spaces where systems and information live.
How a self-led small team implements it
A locked office with keys tracked, or a shared building's badge system, is legitimate evidence at small scale.
What auditors expect to see
Entry control mechanism, key/badge log.
Track A.7.2 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS