ISO 27001 A.7.4: Make physical security monitoring effective

What A.7.4 requires in practice

Annex A control 7.4 asks the organisation to monitor its premises continuously for physical access that has not been approved. The important word is monitor: the aim is to notice an unauthorised entry or attempt, and to be able to act on it. That may involve cameras, alarms, guards or a combination, depending on the premises and risks. The control has three practical parts. Decide which areas and situations need watching, including out-of-hours periods. Make sure the monitoring produces usable signals, such as clear images or alarms that reach a person. Define what happens next, meaning who assesses the signal and how it is escalated. The outputs are a monitoring arrangement that fits the premises, a response routine, and evidence that the equipment and people involved are working. The standard does not name a supplier, technology or recording period.

Specify what the monitoring must establish

Begin with the protected areas and the access scenarios that matter. Decide what a meaningful event looks like, which parts of the premises need coverage and how operating hours affect the arrangement. Monitoring a busy entrance and detecting unexpected access to an unoccupied equipment room can require different decisions.

Be explicit about the expected outcome. Is the arrangement intended to detect access while it occurs, support later investigation, or both? A recording-only setup may contribute evidence but does not automatically deliver timely detection and response. Consider how alarms, personnel and recording capabilities work together rather than counting devices as the measure of success.

Treat response as part of the monitoring design

For each relevant signal, identify who receives it, how they assess it and where they escalate uncertainty. The responder needs enough context to distinguish an authorised maintenance visit from an unexplained event. Working instructions should also address unavailable contacts, a failed monitoring connection and recurring nuisance alarms.

A contracted service can provide part of the arrangement, but responsibilities still need to be agreed. Confirm coverage hours, notification routes, fault handling and the information the provider requires when the site changes. Do not assume that a contract labelled “24-hour monitoring” means every event produces the response your organisation expects.

Why physical monitoring matters to the business

Locks and badges delay an intruder, but monitoring tells you that something is happening, and that is what allows a timely response. Without it, an unauthorised visit to an equipment room might only be discovered when something is missing or fails. Monitoring also supports investigation: usable records help establish what happened, protect innocent staff from suspicion and support insurance or legal processes. Customers with strict requirements may ask about site surveillance. During audit, the difference between monitoring that exists and monitoring that works becomes clear when alarms and recordings are tested, so a response-minded arrangement stands out.

How to implement A.7.4

Define the purpose of the monitoring first, then choose the means. Keep the scope realistic for the size of the site, because a small office needs a proportionate arrangement and not a copy of a large facility. Record why the chosen coverage is considered sufficient.

1. Identify the protected areas and the situations that matter, such as entry to an unoccupied equipment room at night.
2. State whether the aim is to detect while it happens, to support later investigation, or both.
3. Choose monitoring arrangements that suit each area, and confirm that images or alarm signals are usable in practice.
4. Define who receives each type of signal, how they assess it and where they escalate if unsure.
5. Give responders enough context, such as expected maintenance visits, to tell routine from unusual events.
6. Test the arrangement on a regular basis, including alarm delivery, recording quality and the responder's contact details.
7. Where a provider supplies monitoring, agree what it covers, how you receive information and who maintains the equipment.

Illustrative construction example: monitoring a temporary records office

Illustrative BPO example: a camera that observes the wrong area

A fictional BPO centre rearranges reception furniture and moves the entrance to a restricted processing area. Its camera still operates, but the new layout prevents the monitoring team from seeing the relevant access point clearly. The system dashboard reports normal device status, which staff mistake for effective coverage.

Facilities and security review the new arrangement using a harmless, authorised walkthrough. They adjust the monitoring design after considering the purpose and applicable privacy requirements, then confirm that the intended event can be detected and understood. They also check that confidential information on staff screens is not captured unnecessarily. Device health and useful coverage are recorded as separate checks.

Protect the monitoring system and the information it creates

Monitoring equipment and services can themselves become security dependencies. Restrict administration, protect access to recordings and review who can disable or change the system. Technical maintenance should include relevant power, communication and fault conditions. Sensitive coverage information should be available to those who need it rather than casually distributed.

Monitoring people and retaining footage can engage privacy and employment obligations. Determine the applicable requirements, purpose, access and retention before introducing the arrangement. The control is not permission for unlimited observation. Use appropriate specialist advice for jurisdiction-specific decisions; neither an ISO certificate nor a generic policy establishes lawful surveillance in every country.

Evidence, tests and failure patterns