ISO 27001 Control 7.4: Physical Security Monitoring

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.4, physical security monitoring, requires premises to be monitored for unauthorised physical access. It does not automatically mean CCTV; a small business needs monitoring proportionate to its risk, such as an alarm, building management controls or the landlord’s arrangements, with the reasoning written down.

Physical security monitoring was new in the 2022 edition, and it often worries small businesses. Does ISO 27001 now require CCTV? Do we need an alarm? For most of the businesses I work with, the honest answer is that it depends on what you are protecting, and the starting point is your risk assessment, not a shopping list.

CCTV and alarms are great things to have if you have them. For small businesses they are normally inherited from the building. But they are not mandatory if your risk assessment does not call for them. A small office in a communal building, with everything that matters hosted in the cloud, has a very different risk from a company with a server room on site.

This page covers what 7.4 actually requires and how to decide what is proportionate.

What control 7.4 actually asks for

The control requires premises to be continuously monitored for unauthorised physical access. In practice:

• A way of knowing if someone gets in who should not. Guards, alarms, CCTV, access logs or a combination.
• Proportionate to what is there. Monitoring matched to the risk at each location.
• Working and watched. Alarms that are set, cameras that record, and someone who responds.
• Handled lawfully. CCTV is personal data and must be used in line with data protection law.

There was no direct equivalent in the 2013 edition. It is one of the 11 new controls added in 2022.

Start with the risk, not the camera

The question to ask is: if someone got into our premises without authorisation, what could they reach? If the answer is a few desks, a printer and a router in a locked cabinet, because every system that matters is in the cloud, then building-level monitoring by your landlord may be entirely proportionate. If the answer is a server room holding customer data, you need to know quickly when someone is in it who should not be.

So the approach depends fundamentally on where your processing happens. Write down that reasoning in your risk assessment, and the right level of monitoring follows from it.

Inherited monitoring

For most small businesses, monitoring is inherited. The building has CCTV in the common areas, an alarm out of hours, and perhaps a manned reception. Your cloud provider’s data centres are monitored around the clock, as described in their published security documentation and assurance reports.

Record what you inherit, and ask the landlord the useful questions: is there CCTV, who watches it, how long is footage kept, and would they tell you if there were an incident affecting your space?

If you do install CCTV

CCTV records people, so it is personal data. Tell people it is there, point it at what you need to protect rather than at desks or neighbours, keep footage only as long as you need it, and restrict who can view it. The ICO’s data security guidance covers CCTV alongside other physical measures.

What auditors will look for

For monitoring, I ask what you would do with the footage or alarm, not just whether it exists.

1. The risk assessment. Does it consider unauthorised physical access, and does the monitoring follow from it?
2. What exists. Alarms, CCTV, guards, access logs, at each location.
3. Inherited monitoring. What the landlord and cloud provider do, and how you know.
4. Response. Who is alerted, and what happens next?
5. CCTV handling, if you have it.

Common issues

• CCTV bought because the standard “requires it”, with no risk reasoning.
• Alarms that are rarely set.
• Cameras that record but nobody ever checks.
• No idea what the building’s own monitoring covers.
• CCTV with no signage, no retention period and open access to footage.

The self-check

Ask yourself what you would actually do with the footage.

• If someone got into your office tonight, what could they reach?
• Would anyone know?
• What monitoring does your landlord or co-working provider provide?
• Does your risk assessment explain why your level of monitoring is enough?
• If you have CCTV, how long is footage kept and who can see it?

CCTV: usually inherited, rarely watched

For most of my clients, CCTV is something the landlord provides, and the right answer is to record it as an inherited control. Only one client I have worked with had installed its own cameras. Nobody monitored them. They existed to look back in time if something happened, which is a legitimate purpose, but it is recording, not monitoring.

There are also times I wish CCTV had been there. When laptops were stolen overnight from a swipe-card office at the education charity I worked for (see control 7.1), nobody could say whether it was an insider or someone who had tailgated in. A camera on the entrance would have answered that in minutes. Decide what you need: a deterrent, a way to investigate after the event, or genuine monitoring. Then choose accordingly and write the reasoning down.

How control 7.4 links to other clauses and controls

• Control 7.1, Physical security perimeters. What is being monitored.
• Control 7.2, Physical entry. Access logs are a form of monitoring.
• Control 5.34, Privacy and protection of PII. CCTV footage is personal data.
• Control 6.8, Information security event reporting. Signs of unauthorised access should be reported.
• Clause 6.1.2, Information security risk assessment. Where the level of monitoring is decided.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• A guide to data security. ICO guidance, including CCTV and physical security.
• How Google protects data centres. An example of how a cloud provider describes the monitoring you inherit.
• Unauthorised entry. NPSA guidance on access control, CCTV and intruder detection.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call