ISO 27001 Control A.7.4: Physical Security Monitoring

Locks, badges and well-designed rooms all try to stop the wrong person getting in. A.7.4 deals with the question that follows: what if one of them fails and nobody notices? Physical security monitoring is how you find out that a door was forced, propped open or tailgated through, while there is still time to do something about it. This is the fourth of 14 physical controls in our walk through Annex A, and the first one that is detective rather than preventive.

Many organizations assume they already meet this control because a camera is mounted above the front door. A camera that nobody watches, records over itself every 48 hours, or points at the wrong corridor is decoration rather than monitoring. The aim here is to make sure the right areas are covered, someone responds to what the system sees, and you can prove both.

What the control requires

Annex A control 7.4 of ISO 27001:2022 states that premises shall be continuously monitored for unauthorized physical access.

The key elements:

Premises - the buildings, floors and secure areas defined by your perimeters, not just the front door
Continuously - monitoring that runs outside working hours as well as during them, whether through people, technology or both
Unauthorized physical access - the thing being detected; the control is about spotting entry that should not have happened

A.7.4 is a detective control - it does not stop an intruder, it makes sure an intrusion is noticed and can be acted on. Annex A states the control; ISO 27002 gives guidance on the monitoring methods and how to use them proportionately. Note that “continuously” does not necessarily mean a person staring at screens around the clock. An alarm that reliably alerts a monitoring service at 3am can meet the intent just as well.

How to implement physical security monitoring

Match the monitoring to the risk

Start from the areas you identified when designing perimeters and securing offices, rooms and facilities. Server rooms, record stores, loading bays, emergency exits and any ground-floor or roof access points deserve more attention than a staff kitchen. Typical measures include:

Intruder alarms with door contacts and motion sensors, armed whenever an area is unoccupied
Video surveillance covering entrances, exits and the approaches to sensitive rooms
Security guards or a reception function that watches and responds
Alarms on emergency exits that sound or alert when opened

Choose a mix that fits the size and risk of the site. A ten-person office in a shared building may rely on the landlord’s guarding plus its own alarm on the server cupboard; a data-handling facility will layer all four.

Make sure someone responds

Detection without response is a recurring audit finding. For every alert type, decide who receives it, how quickly they must act, and what they do next. That means a monitoring contract or an on-call list, not an email to a shared inbox that nobody reads at weekends. Write the escalation path down and test it: set off the alarm on a quiet evening and see how long it takes for a person to react.

Tie the response into your incident process. A forced door or an alarm triggered in a secure area is a security event, and staff and contractors should know how to raise it - the same reporting habits we describe under event reporting. Log the alert, the response and the outcome so there is a trail to show.

Protect the monitoring system itself

Monitoring equipment is a target and an asset in its own right. Cameras and alarm panels should be tamper-evident, powered with a backup, and placed so they cannot be easily disabled or blinded. Recording equipment belongs in a locked, access-controlled location, not under a reception desk. If the system is network-connected, treat it like any other networked device: change default credentials, patch firmware, and keep it off flat networks where a compromised camera could reach business systems. Finally, check coverage periodically - a plant that has grown in front of a lens or a camera quietly knocked out of alignment defeats the point.

Handle footage and privacy lawfully

Video of people is personal data in most jurisdictions. Decide and document why you record, how long footage is retained, who may view it, and how requests for access are handled. Post clear notices where cameras operate, and avoid areas where people reasonably expect privacy, such as washrooms and changing areas. Retention should be long enough to investigate an incident - typically weeks rather than days - but not indefinite. Where a landlord or guarding provider operates the cameras, confirm who holds the footage and how you obtain it when you need it.

A.7.1 connection. Physical security perimeters define the boundaries that monitoring needs to cover.

A.7.2 connection. Physical entry controls who is allowed in; monitoring tells you when someone got in anyway, for example by tailgating.

A.7.3 connection. Securing offices, rooms and facilities decides which rooms matter most, which in turn tells you where monitoring effort belongs.

A.6.8 connection. Event reporting is how people raise what they observe when the technology misses it or confirms it.

Clause 9.1 connection. Clause 9.1, Monitoring, measurement, analysis and evaluation, expects you to evaluate whether your controls work. Alarm tests, response times and coverage checks are natural evidence.

What auditors check

Coverage against risk. Auditors compare the monitoring in place with the areas you have identified as sensitive and look for gaps, such as a server room with strong locks and no alarm.

Out-of-hours arrangements. They ask what happens at night and at weekends, who receives alerts, and whether the answer matches what staff actually describe.

Evidence of response. Expect requests for alarm logs, incident records and test results showing that alerts are acted on, not merely generated.

Operational condition. Auditors may ask to see the camera views or alarm panel on site, and check that devices are working, recording and correctly positioned.

Footage handling. They look for a documented retention period, restricted access to recordings, and consistency with data protection obligations.

Maintenance and testing. Service records, battery checks and periodic alarm tests show that monitoring is treated as an ongoing control.

Common mistakes to avoid

Cameras with nobody watching or reviewing. Recording only helps after the fact, and only if someone knows to look. Decide what triggers a review.

No out-of-hours response. An alarm that sends an email nobody reads until Monday does not meet the word “continuously”.

Dummy or broken devices. A camera that is not working gives false confidence and an auditor will find it quickly. Check that every device records.

Retention that is too short or unlimited. Footage overwritten after a day is useless for investigation; footage kept forever creates a privacy problem.

Unsecured monitoring systems. Default passwords on network cameras and recorders left in open areas turn the control into a weakness.

Ignoring shared-building monitoring. If the landlord runs the cameras, you still need to know what is covered, who responds, and how you get access to the footage.

How 27kay can help

We help organizations design monitoring that is proportionate to the risk, so you are not buying cameras for the sake of it or leaving a sensitive room unwatched. As part of ISO 27001 implementation, we review what you have, help you define who responds and how quickly, and prepare the evidence an auditor will ask for. For the full picture, see our ISO 27001 knowledge hub.

If an alarm went off in your building tonight, would anyone act on it? Get in touch - we will help you find out before an auditor, or an intruder, does.