Implementing ISO 27001 Annex A 7.4 Physical Security Monitoring is the strategic deployment of continuous surveillance and intrusion detection systems to protect sensitive environments. This control provides the Business Benefit of real-time threat visibility and forensic accountability, ensuring that physical breaches are detected and remediated before causing significant data loss.
ISO 27001 Annex A Physical Security Monitoring Implementation Checklist
Use this implementation checklist to achieve compliance with ISO 27001 Annex A 7.4. This control mandates the continuous monitoring of physical premises to detect, prevent, and respond to unauthorised physical access or environmental threats, moving beyond passive barriers to active technical surveillance.
1. Deploy High-Definition CCTV Infrastructure
Control Requirement: Premises must be continuously monitored for unauthorised access. Required Implementation Step: Install 4K IP cameras at all entry and exit points, including delivery bays and emergency escapes. Ensure the cameras use Power over Ethernet (PoE) and are connected to a dedicated, air-gapped VLAN to prevent network-based tampering or bandwidth throttling.
Minimum Requirement: 24/7 visual coverage of all external perimeters and internal secure zone entry points.
2. Implement Motion and Intrusion Sensors
Control Requirement: Monitoring must detect actual intrusions in real-time. Required Implementation Step: Fit Passive Infrared (PIR) sensors and dual-technology glass-break detectors in all ground-floor rooms and server facilities. Hard-wire these sensors to a Grade 3 alarm panel that remains functional on battery backup for at least 12 hours during a power failure.
Minimum Requirement: Alarm sensors active in all sensitive areas, integrated with a 24/7 monitoring centre.
3. Configure Real-Time Alerting for Door States
Control Requirement: Physical security events must trigger an immediate response. Required Implementation Step: Install magnetic reed switches on all “Secure Area” doors. Configure the physical access control system (PACS) to trigger a “Door Forced” or “Door Held Open” alarm that sends an instant push notification or SMS to the on-call security officer.
Minimum Requirement: Alerting logic that triggers if a secure door is open for more than 30 seconds.
4. Establish a Tamper-Proof Recording Repository
Control Requirement: Monitoring records must be protected from unauthorised deletion or modification. Required Implementation Step: Secure the Network Video Recorder (NVR) in a locked, bolted-down floor rack within a restricted zone. Enable Write Once Read Many (WORM) storage settings or use off-site RSYNC backups to ensure footage cannot be deleted by an intruder or a disgruntled administrator.
Minimum Requirement: Securely stored footage with a verified 90-day retention period.
5. Integrate Environmental Monitoring Sensors
Control Requirement: Physical monitoring must include environmental threats to information processing facilities. Required Implementation Step: Deploy networked temperature, humidity, and water-leak sensors at the base of every server rack. Integrate these with your SNMP monitoring tool (e.g., Zabbix or Nagios) to detect HVAC failures or pipe bursts before they result in hardware damage.
Minimum Requirement: Active environmental monitoring in the primary server room with automated critical thresholds.
6. Formalise Security Guard Patrols and Verification
Control Requirement: Monitoring should include physical verification where appropriate. Required Implementation Step: If using on-site security, implement a “Guard Tour” system using NFC tags at key points (server room, loading bay, reception). The system must log the exact time a guard physically checked the area, ensuring that “monitoring” isn’t just a guard sitting behind a desk.
Minimum Requirement: Weekly digital logs showing completed physical security sweeps of the entire premises.
7. Conduct Monthly Surveillance ‘Health Checks’
Control Requirement: Monitoring systems must be maintained and verified for operationality. Required Implementation Step: Manually verify camera feeds once a month. Check for lens obstructions, “dead” infrared LEDs, and NVR disk health. Document these checks in a maintenance log to prove to auditors that the system isn’t just installed, but actually functional.
Minimum Requirement: A dated maintenance log confirming all cameras and sensors are online and clear.
8. Implement Video Analytics for Loitering and Unattended Objects
Control Requirement: Use advanced detection methods to enhance monitoring effectiveness. Required Implementation Step: Enable AI-driven video analytics on your NVR to detect loitering at the perimeter or “object left behind” in the lobby. This reduces “monitor fatigue” for security staff by only flagging suspicious behavioural patterns for manual review.
Minimum Requirement: Active behavioural analytics configured on at least the primary external entry point.
9. Audit Access Control System (PACS) Logs
Control Requirement: Monitoring records must be reviewed for anomalies. Required Implementation Step: Export the PACS entry logs every Monday. Manually review for “out of hours” entries or repeated access denials for specific individuals. Cross-reference these with the HR leaver list to ensure no “ghost fobs” are still attempting entry.
Minimum Requirement: Evidence of weekly management review of physical access logs.
10. Execute unannounced ‘Red Team’ Monitoring Tests
Control Requirement: The effectiveness of monitoring must be tested. Required Implementation Step: Have a non-IT staff member attempt to enter a secure zone without a badge (tailgating) or place a sticker over a camera lens. Measure the time it takes for the monitoring system (or guard) to detect the event and initiate an intervention.
Minimum Requirement: A quarterly “Physical Monitoring Effectiveness” report detailing test results and remediation.
ISO 27001 Annex A 7.4 SaaS / GRC Platform Implementation Failure Checklist
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Continuous Monitoring | Checking a box saying “CCTV is installed”. | If the NVR crashed three weeks ago and nobody noticed, you have 0% monitoring. GRC tools don’t monitor uptime. |
| Intrusion Detection | Assigned a “Task” to the facility manager to check alarms. | Tasks aren’t controls. Unless the alarm is hard-wired to a 24/7 ARC (Alarm Receiving Centre), an alert at 2 AM is useless. |
| Footage Retention | Policy states “90 days of footage is kept”. | High-resolution 4K video consumes TBs of data. GRC tools don’t check if your storage array is actually large enough for 90 days. |
| Environmental Detection | “Fire suppression system is serviced”. | Servicing once a year is not monitoring. You need live humidity and water-leak sensors reporting into a dashboard IT actually sees. |
| Log Review | GRC tool shows “Logs are reviewed” as 100% complete. | Did the reviewer look for tailgating? Did they check for fobs used at 3 AM? Automated GRC tasks encourage pencil-whipping. |
| Physical Verification | Trusting the landlord’s security guards. | The landlord’s guard works for the landlord, not you. Without your own independent monitoring of your suite, your data is at risk. |
| Tamper Protection | Recording that the NVR is “In a secure room”. | Is the NVR password default “admin/admin”? GRC tools never check the technical hardening of the surveillance hardware itself. |
About the author
