Control A.7.4Physical security monitoring
Premises must be continuously monitored for unauthorised physical access.
New in the 2022 edition. The word that changes the requirement is continuously: a monitored perimeter is not one that is reviewed after an incident, it is one that would produce an alert or a record at the time.
Implementations range from staffed reception and patrols to alarms, sensors and video, and the choice follows the risk assessment. What matters is that unauthorised access would be noticed and that there is a record to examine afterwards.
Two practical constraints. Monitoring that produces recordings nobody watches detects nothing in real time, which is acceptable if the detection is expected to come from elsewhere and not if the recording is the control. And video monitoring processes personal data, which brings A.5.34 and data protection law into the design — retention, signage, lawful basis and access to the footage all have to be decided rather than assumed.
How to put this in place
Premises need a way to notice unauthorised entry, scaled to what they hold. Cameras nobody reviews and alarms nobody answers give false assurance.
- Decide whether monitoring is needed at each site, based on risk and what is held there.
- Choose proportionate measures, such as an intruder alarm, entrance cameras or access alerts.
- Name who responds to an alert and what they do.
- Set a retention period for footage within privacy law and tell people it exists.
- Test the equipment and the response regularly, and record the tests.
Evidence an auditor usually looks for: maintenance and test records for alarms and cameras, response arrangements, retention settings and privacy notices.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.