A.7.4 Physical security monitoring
Continuously monitor premises for unauthorized physical access.
16
artefacts
3
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- CCTV system maintenance log · Physical access / facilities
- Electronic badge swipe logs · Physical access / facilities
- Access control system audit trail · Identity provider / directory
periodic reviewEvidence produced at each review
- Access control hardware service records · Identity provider / directory
- Alarm system test results · Source control / CI pipeline
governing documentDocuments that govern the control
- Daily CCTV footage archive index · Policy repository / GRC workspace
- Video retention policy document · Policy repository / GRC workspace
- Camera placement diagram · Policy repository / GRC workspace
- Visitor sign‑in register · Policy repository / GRC workspace
- Door alarm event report · Policy repository / GRC workspace
- Physical security breach incident report · Policy repository / GRC workspace
- Unauthorized access investigation summary · Document repository
- Root cause analysis of access violations · Document repository
- Corrective action tracking sheet · Policy repository / GRC workspace
- CCTV camera maintenance schedule · Policy repository / GRC workspace
- Security equipment calibration certificates · Document repository
First move
Mostly documents and reviews. Pull the 3 system-held artefacts from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- logs not retained for required period
- camera blind spots unaddressed
- manual log entries not synchronized with electronic records
- lack of regular testing of alarm systems
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.7.3 Securing offices, rooms and facilities · A.7.5 Protecting against physical and environmental threats