Physical security monitoring

What the requirement asks

Premises are to be watched continuously for unauthorized physical entry. Purpose: detect and discourage unauthorized physical access. Guidance: surveillance can combine guards, intruder alarms, CCTV and similar video systems, and physical security information management software, run in-house or by a monitoring provider. Buildings housing critical systems should be watched continuously for intrusion or suspicious behaviour by installing video systems that view and record entry to sensitive areas inside and outside the premises; by installing to applicable standards, and testing periodically, contact, sound or motion detectors that raise an intruder alarm, such as contact sensors on doors, windows or under objects usable as panic alarms, infrared motion sensors and glass-break sound sensors; and by covering all external doors and reachable windows with alarms, keeping unoccupied areas alarmed at all times and covering other areas such as computer and communications rooms. How the monitoring is laid out stays confidential, since knowing it helps intruders avoid detection, and the systems are protected so video feeds cannot be viewed by unauthorized people and the systems cannot be switched off remotely. The alarm control panel is placed inside an alarmed zone and, where it serves safety alarms, close to a clear exit for whoever sets it; panel and detectors are tamper-proof, and the system is tested regularly, especially battery-powered parts. Monitoring and recording must respect local law, including data protection rules on monitoring staff and on how long video is kept. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Monitoring is only useful if someone reviews it. The guidance asks for the coverage, the retention, the review and the response to an event.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep coverage plans for CCTV and intruder detection over sensitive areas, external doors, accessible windows and unoccupied zones and one live sample together.

Evidence an assessor asks for

• Surveillance and alarmsCoverage plans for CCTV and intruder detection over sensitive areas, external doors, accessible windows and unoccupied zones
• Surveillance and alarmsAlarm and detector installation certificates to applicable standards and periodic test records, including battery-powered components
• Surveillance and alarmsMonitoring logs or monitoring-provider reports showing alarms raised and responses
• Surveillance and alarmsAccess restrictions and hardening of CCTV and alarm systems, including protection of video feeds and remote management
• Surveillance and alarmsEvidence that the alarm panel is located in an alarmed zone with tamper protection
• Surveillance and alarmsA privacy or legal assessment covering staff monitoring and video retention periods

The question an assessor will ask

An assessor will ask for coverage plans for CCTV and intruder detection over sensitive areas, external doors, accessible windows and unoccupied zones, then trace it to the system it protects. For A.7.4 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• CCTV records but nobody reviews footage or responds to alerts
• Detectors are installed but never tested, with flat batteries unnoticed
• Video systems are exposed on the network with default credentials
• Video is retained longer than local law permits

Before the next audit

Before the next audit, check one live sample for this gap: cctv records but nobody reviews footage or responds to alerts.