7.4 Physical security monitoring

Premises are to be watched continuously for unauthorized physical entry. Purpose: detect and discourage unauthorized physical access. Guidance: surveillance can combine guards, intruder alarms, CCTV and similar video systems, and physical security information management software, run in-house or by a monitoring provider. Buildings housing critical systems should be watched continuously for intrusion or suspicious behaviour by installing video systems that view and record entry to sensitive areas inside and outside the premises; by installing to applicable standards, and testing periodically, contact, sound or motion detectors that raise an intruder alarm, such as contact sensors on doors, windows or under objects usable as panic alarms, infrared motion sensors and glass-break sound sensors; and by covering all external doors and reachable windows with alarms, keeping unoccupied areas alarmed at all times and covering other areas such as computer and communications rooms. How the monitoring is laid out stays confidential, since knowing it helps intruders avoid detection, and the systems are protected so video feeds cannot be viewed by unauthorized people and the systems cannot be switched off remotely. The alarm control panel is placed inside an alarmed zone and, where it serves safety alarms, close to a clear exit for whoever sets it; panel and detectors are tamper-proof, and the system is tested regularly, especially battery-powered parts. Monitoring and recording must respect local law, including data protection rules on monitoring staff and on how long video is kept.

Source: ISO/IEC 27002:2022, 7.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.