ISO 27001 Annex A 7.4: physical security monitoring without guards

The due-diligence questionnaire asks what monitors your office out of hours. You have door entry and a good lock, but no clear answer for 2am on a Sunday, and the deal is waiting. This guide explains what ISO 27001 Annex A 7.4 expects and how a firm of 25–250 people can meet it without guards or a control room.

It is written for information security managers, compliance leads and IT or operations directors preparing for ISO/IEC 27001:2022 certification or moving over from the 2013 control set. ISO 27001 physical security monitoring turns out to be mostly engineering discipline: a small estate, tested on a rhythm, with evidence as a by-product.

What does ISO 27001 Annex A 7.4 physical security monitoring require?

ISO 27001 Annex A 7.4 asks you to keep watch over your premises at all times, so that anyone who gets in without authority is detected. New in the 2022 revision, it expects a proportionate mix of alarms, detectors, cameras or people, covering empty spaces and rooms holding critical equipment. The monitoring system itself must be protected, tested and privacy-compliant.

Annex A 7.4 completes a sequence. Annex A 7.1 builds the perimeter and Annex A 7.2 controls the door, so 7.4 asks whether you would know if someone got in anyway. Auditors treat it as a probe of operational discipline: anyone can install cameras, but are the alarms tested and the contact list current?

The control works in two ways. It is detective, because it notices an intrusion as it happens or reconstructs it afterwards, and preventive, because visible cameras and alarm signage deter the attempt. Confidentiality, integrity and availability all apply, since an undetected intruder can copy, tamper with or remove whatever the premises hold.

Firms moving from the 2013 control set often find real gaps here, so treat it as a fresh requirement, not a renamed one. A gap costs something concrete: a stolen laptop found on Monday, a weekend of exposure, and a breach notification that has to say "we don't know".

Privacy sits inside the control too. Footage of identifiable people is personal data, so a carelessly run camera system is its own liability.

Which surveillance and detection systems satisfy ISO 27001 Annex A physical security monitoring?

Most firms at this scale meet the control with an alarm system armed out of hours, monitored by an alarm receiving centre, plus recording cameras on entrances and the server room. Guards and monitoring centres are for risks that genuinely justify them. Coverage is judged from an intruder's viewpoint, not reception's.

Let the risk assessment set the ambition. A firm holding client data on a server in the office needs more than one that is fully cloud-hosted, but neither needs a staffed control room by default. Among physical security controls, this one scales down well.

A proportionate baseline looks like this:

• Monitored intruder alarm armed whenever the office is empty, connected to an alarm receiving centre (ARC) rather than a siren nobody hears.
• Recording cameras on external doors, reception and the server room or comms area.
• Detectors on reachable windows, unoccupied floors and rooms holding critical kit.
• Battery backup on the panel and detectors, with battery state included in testing.

Match the sensor to the threat. Contacts suit doors, motion detection suits open floors, glass-break sensors suit reachable windows, and a camera answers the question of who rather than just that. Between an unmonitored siren and a guard rota sits keyholder response: the ARC calls a named person or a response service who attends. That step suits most offices better than a rota.

Blind spots cluster at the back: secondary exits, smoking doors and loading entrances. Reception gets three cameras while the fire exit propped open for smokers gets none. Check coverage from the outside, in this order:

1. Walk the outside first. List every external door, reachable window and roof or yard access.
2. Match each opening to a sensor or camera view. An opening with neither is a gap.
3. Check the quiet interior. Unoccupied floors and the comms cupboard need cover when nobody is about.
4. Record each decision. Where you accept a gap, write down why, because auditors ask what you decided about blind spots.

A walk-round also exposes quietly degraded kit, such as cameras unplugged after a false-alarm spree or detectors disconnected because they kept triggering. Each one is a finding waiting for the auditor's own walk-round. Monitor fire exits with a contact or a camera, never with anything that slows the way out: monitoring must not impede emergency exit.

The table maps each area to a proportionate measure and the evidence that backs it.

How long should CCTV footage be retained under UK GDPR and the DPA 2018?

UK GDPR and the DPA 2018 set no fixed CCTV retention period, so you choose one, justify it and configure it on the recorder; 30–90 days is the common range. You also need visible signage, a legitimate interest assessment, logged and restricted footage access, and cameras used only for their stated security purpose.

The ICO is explicit that data protection law prescribes no minimum or maximum retention period for surveillance footage. Retention follows purpose and should be the shortest justifiable period, as set out in the ICO guidance on complying with data protection principles when using surveillance systems.

For a 50-person office, a window towards the lower end of the range usually serves the purpose. If you review alarm events and door records every week, anything worth keeping is found and exported long before a short window runs out. Write the reasoning into your legitimate interest assessment, then set the figure on the recorder itself.

Keeping footage longer isn't diligence. It's exposure.

The privacy pack has five parts:

• Signage. The GOV.UK business guidance on using CCTV says signs must be clearly visible and readable, so place them at entrances and inside monitored areas.
• Legitimate interest assessment. Record why cameras are necessary and which less intrusive options you considered.
• Restricted, logged access. Named people only, with a log of who views or exports footage.
• Purpose limitation. Cameras serve security, not productivity checks or general employee monitoring, and never point where privacy expectations are absolute, such as toilets.
• DPIA. The ICO expects a data protection impact assessment for most surveillance systems, and one is essential when cameras watch people at their desks.

Retention must be demonstrable on the box, not just asserted in policy. Auditors compare the recorder's actual setting with the stated one, so export the configuration screen and file it with the policy.

Footage of identifiable people can also be requested by those people. The same government guidance says you must usually provide the footage free of charge within one calendar month, so make sure someone knows how to export a clip and how to handle other people who appear in it.

Privacy handled by accident looks like missing signage, footage kept forever and recordings viewable by anyone with the office wifi password. A certification auditor can grade that against your legal-requirements obligations as well as against this control.

How do you protect the monitoring system itself?

The monitoring system is an asset to protect. Restrict feeds and recordings to named people, fit panels and detectors with tamper detection, site the alarm panel inside the alarmed zone, and treat the camera and sensor layout as confidential, because a plan of your blind spots is a burglar's shopping list.

Four measures harden the system:

• Named access only. Individual accounts on the recorder and camera platform, no shared admin login, and no default passwords.
• Tamper detection. Panels, detectors and cabling report opened covers or cut lines to the ARC as a fault or alarm.
• Panel inside the alarmed zone. An intruder who reaches the panel has already triggered a detector, so the panel cannot be silenced unseen.
• Confidential layout. Keep the sensor and camera plan in a restricted folder, shared with installers and the ARC only as needed.

Cameras and recorders are networked computers. Keep them on their own network segment where you can, patch their firmware and review who holds accounts at each leaver event.

Review the recorder's access and export log each quarter and sign it off. It shows who viewed or exported footage, and it doubles as evidence for the privacy pack above.

The layout rule catches people out because installers hand over a tidy plan and the plan then lives on a shared drive. Mark it confidential in your information classification scheme and treat it like a network diagram.

Who monitors what in a shared or serviced building?

In a serviced or shared building, the landlord's cameras and alarms cover the shell, not your suite. Establish and evidence what the operator monitors, then fill only your own gaps, usually the suite door and the comms cupboard. Accountability for monitoring your critical assets stays with you under the control.

Put these questions to the building manager in writing:

• Which areas do the landlord's cameras cover, and do they reach your suite door or the corridor outside it?
• Does the building alarm cover your suite out of hours, or only the common parts?
• How long is footage kept, and how do you request a clip after an incident?
• Who does the ARC call, and in what order?

The answers show where the shell ends. Most gaps sit at the suite door and the comms cupboard, which a door contact, a camera or a detector can close. Check the lease first, because fixing devices to a landlord's structure usually needs written consent.

Serviced offices often provide a staffed reception but no out-of-hours monitoring of individual suites. Never assume the reception desk is the monitoring.

Keep the replies, the operator's service description and the date you received them in your supplier records. A landlord can change cameras or contractors without telling tenants, so re-confirm coverage at your annual supplier review. Auditors accept shared monitoring when you can show what it covers, and they do not accept "the landlord handles it".

How do you keep out-of-hours escalation paths and call-out lists current?

Keep an out-of-hours call-out list that names current staff, and reconcile it against your HR system on a schedule so leavers drop off automatically. Agree the escalation path with your alarm receiving centre, and version-control the procedure with review dates. That answers the auditor's 2am question.

A monitored alarm is only as good as the person it wakes. An alarm that rings an ex-employee's phone is theatre.

Four habits keep the escalation path live:

1. Name at least two keyholders in ranked order, by role as well as name, so one holiday doesn't break the chain.
2. Agree the escalation path with the ARC in writing: who is called first, how long before the next call, and when a response service attends.
3. Reconcile the call-out list against HR data monthly and on every leaver, ideally as an automated job.
4. Version-control the procedure with an owner, a date and a review date.

Auditors quiz whoever is named on the list, including whether they still work for you. A drill call once a year proves the numbers connect and the person knows what to do.

Contact hygiene extends to the ARC's own records. The ARC calls from its copy of the list, not yours, so when a keyholder changes, update both lists the same day.

What do ISO 27001 auditors ask about physical security monitoring, and how is it graded?

Auditors ask what watches the building at 2am and who is woken, then sample a recent alarm event, the test log, the recorder's actual retention setting and the call-out list. The walk-round checks rear blind spots. Missing detection around critical assets grades major; lapsed tests or stale contacts grade minor, aggregating to major.

Expect these questions in the room:

• "What's watching this building at 2am, and who gets woken if it triggers?"
• "Show me your last few alarm tests, and the last time a test failed."
• "Who can view or export camera footage, and how would you know if someone did?"
• "How long do recordings persist, and where is that configured?"
• "Where are your blind spots, and what did you decide about them?"

An alarm that has never failed a test has probably never been tested.

Certification bodies read patterns. One missed test is a minor finding, but missed tests, stale contacts and unreviewed logs together read as a control that exists on paper only. Signage and footage-access controls are checked wherever cameras are in scope.

Auditors want proof the system runs, so assemble this evidence before the visit:

• The monitoring procedure or the relevant section of your physical security policy.
• Uptime and time-sync records for cameras and recorders.
• Alarm and detector test logs across the year, plus maintenance records.
• Signed log checks reconciling alarm events with door-system records, which carry the most weight because they show a human in the loop.
• Current escalation contacts and incident tickets from real or drill events.
• The privacy pack: signage, retention configuration and a DPIA where applicable.

How do you automate A.7.4 monitoring health checks and alarm testing?

Poll cameras and recorders for uptime and disk-write status and alert on silence, so a dead recorder becomes a same-day ticket. Schedule alarm tests as jobs that raise their own tickets, and feed alarm and door events into your existing log pipeline. The closed tickets become audit evidence automatically.

The NCSC makes the same point for logs: build an automated alert for when logs stop arriving centrally, or when a periodic test event is not captured. Its guidance is in NCSC 10 Steps to Cyber Security: Logging and monitoring. Physical monitoring deserves the same treatment as any other log feed.

Four jobs cover most of the control:

• Health polling. Check each camera's heartbeat, the recorder's uptime and time sync, and whether the disk is actually writing. Alert on silence, not only on errors.
• Alarm tests as tickets. The monthly test creates its own ticket, the tester records results, and the closed ticket is the evidence. Missed tests show up as overdue items.
• Events into the log pipeline. Send alarm, door and tamper events to whatever already aggregates your logs, and alert on out-of-hours entry, tamper signals and detector faults.
• Reviews as recurring tasks. A scheduled task compares alarm events against door-system records, and the reviewer signs it off.

Retention and the call-out list from the earlier sections belong in the same engine: retention as documented recorder configuration exported on a schedule, and the roster reconciled against HR data. The privacy answer and the audit answer become the same artefact.

Monitoring that fails quietly is worse than none, because everyone trusts it.

A quarterly walk-round finds degraded kit months late; polling finds it the same day. And without a testing rhythm, the first real test of the alarm is the intrusion itself.

At this scale the recurring cost is a couple of hours a month: clearing the test tickets, signing the log check and reading the exceptions. That cadence satisfies certification auditors and enterprise customers' security questionnaires alike, and the evidence collects itself.

Frequently asked questions