A security zone (zoning concept) divides premises into areas with graduated protection levels. The outermost zone is publicly accessible (e.g. reception), the innermost zone is the most heavily protected (e.g. server room). Each zone transition requires an additional access check. This ensures that sensitive areas can only be reached after passing through multiple layers of protection. In your ISMS you document the zoning concept in a floor plan and link it to the locking system and access-control system. ISO 27001 Annex A 7.1-7.4 provides the basis.