ISO 27001 Physical Security Monitoring: Complete 2026 Guide

ISO 27001 physical security monitoring is the Annex A control that asks a question the 2013 edition never asked: if someone walked into your building tonight, would anyone know? Control A.7.4 was added in the 2022 edition, and it reads as a requirement that premises be continuously monitored for unauthorised physical access. Eleven words, one new line in your Statement of Applicability, and a surprising amount of work behind it — because this is the one Annex A control whose correct implementation can itself be unlawful if you get the paperwork wrong.

This guide covers what A.7.4 actually demands, how ISO 27001 physical security monitoring differs from the physical controls around it, the five methods ISO/IEC 27002 recognises, the review-and-respond limb almost everyone leaves out, and the data protection obligations that attach the moment you point a camera at a door. All of it is written for the organisation that has to pass an audit, not for a vendor trying to sell you cameras.

What ISO 27001 physical security monitoring actually requires

A.7.4 sits in the Physical theme of Annex A, which holds 14 of the standard’s 93 controls. The other three themes are Organizational (37), People (8) and Technological (34). Within that Physical group of 14, A.7.4 is the detective one.

The control statement is short: premises shall be continuously monitored for unauthorised physical access. ISO’s stated purpose for the control is to detect and deter unauthorised physical access, which is why ISO/IEC 27002:2022 classifies ISO 27001 physical security monitoring as both preventive and detective — a visible camera changes behaviour before it ever records anything useful.

What the statement does not say is equally important. It does not name a technology. It does not require CCTV. It does not require a documented policy, and a physical security monitoring policy does not appear on the list of ISO 27001 mandatory documents. It does not state a review frequency, a retention period, or a testing interval. Every number you have seen on a competitor’s page about this control came from that competitor, not from the standard.

Three things follow. First, ISO 27001 physical security monitoring is risk-based: a two-room office and a colocation cage do not get the same answer. Second, because nothing is prescribed, your justification has to be written down somewhere — the Statement of Applicability is where an auditor will look for it. Third, the evidence is behavioural, so you cannot pass this control by producing a document alone.

Why ISO 27001 physical security monitoring is new in 2022

A.7.4 is one of the eleven controls introduced in ISO/IEC 27001:2022 with no predecessor in the 2013 edition. ISO 27001 physical security monitoring is not a renumbering of something older; it is a genuine gap that got filled. Look at where the old A.11.1 family went:

ISO 27001:2013	ISO 27001:2022	Control type
A.11.1.1 Physical security perimeter	A.7.1 Physical security perimeters	Preventive
A.11.1.2 Physical entry controls A.11.1.6 Delivery and loading areas	A.7.2 Physical entry	Preventive
A.11.1.3 Securing offices, rooms and facilities	A.7.3 Securing offices, rooms and facilities	Preventive
A.11.1.4 Protecting against external and environmental threats	A.7.5 Protecting against physical and environmental threats	Preventive
A.11.1.5 Working in secure areas	A.7.6 Working in secure areas	Preventive
No equivalent	A.7.4 Physical security monitoring	Preventive and detective

Read that right-hand column down the page. The 2013 edition asked you to build a perimeter, control the entrances, lock the rooms, shield against flood and fire, and supervise work in secure areas. Every one of those is a barrier. Not one of them asked whether you would find out that a barrier had failed.

So an organisation could have been fully certified against the 2013 edition with a locked server room nobody ever looked at. That is the gap ISO 27001 physical security monitoring closes, and it is why the control feels unfamiliar even to teams that have held a certificate for a decade. If you are mapping your whole control set across editions, our guide to the ISO 27001:2022 controls covers the full 93 and the four themes.

What “continuously” means for ISO 27001 physical security monitoring

Most Annex A control statements tell you what and leave when to the guidance. A.7.4 is unusual in that its own statement carries a temporal qualifier — premises shall be continuously monitored. That single adverb is where real-world arrangements fail, because it rules out three common setups:

• Office-hours-only coverage. A receptionist who watches the door from 09:00 to 17:00 is not continuous ISO 27001 physical security monitoring. The hours when nobody is in the building are precisely the hours the control exists for.
• Systems that have to be armed by hand. An alarm that depends on the last person out remembering to set it is a control with a human single point of failure. Auditors ask to see the arming record, and gaps in it are findings.
• Cameras that record only when someone starts recording. Motion-triggered recording is fine; discretionary recording is not.

“Continuously” does not mean a human stares at a screen all night. It means the detection capability is never off. NIST makes that distinction explicit in a way ISO does not: in NIST SP 800-53 Rev. 5, control enhancement PE-6(3) on video surveillance notes that monitoring the surveillance video is not required, although organisations may choose to do so. Recording continuously and reviewing selectively is a defensible reading of A.7.4. Recording selectively is not.

Five ways to do ISO 27001 physical security monitoring

ISO/IEC 27002:2022 recognises surveillance systems used separately or in combination, and names guards, intruder alarms, video monitoring systems such as closed-circuit television, and physical security information management software, whether run in-house or by a monitoring service provider. Each ISO 27001 physical security monitoring option produces a different artefact, and that artefact is what your auditor samples.

Method	What it actually detects	Evidence it produces	Privacy exposure
Security guards / manned reception	Unexpected people, tailgating, propped doors, behaviour	Patrol logs, shift handover notes, incident reports	Low (unless body-worn, or notes name individuals)
Intruder alarm system	Breach of a contact, movement in an armed zone, glass break	Event log, arm/disarm record, call-out records	Low
Video monitoring system (CCTV/VSS)	Who, when and what they did — after the fact	Footage, retention settings, access log to the footage	High — personal data, almost always
Physical access control system (PACS) logs	Credential use, failed reads, out-of-sequence entries	Badge event log, anti-passback exceptions, access reviews	Medium — identifies named employees
PSIM or monitoring service provider	Correlated events across all of the above	Correlated alert log, SLA and escalation records	High — adds a processor to your supply chain

Two practical notes. A guard-only answer is perfectly valid for a small office and is often cheaper to evidence than a camera system, because it carries almost no data protection overhead. And the bottom row is where organisations accidentally create work: the moment a third party performs your ISO 27001 physical security monitoring, that provider sits inside the scope of your supplier controls (A.5.19 to A.5.22) and, where footage of identifiable people is involved, needs a processor contract as well.

ISO 27001 physical security monitoring: detectors, panels and installation

The 27002 guidance for this control goes down to the level of hardware, which is unusual and worth knowing before a stage 2 audit. It describes three detector families and several installation conditions.

Detector type	Triggers on	Typical placement	Common weakness
Contact detector	A contact being made or broken	Doors, windows, cabinet and rack doors	Defeated by entry through a wall, ceiling or raised floor
Motion detector (infra-red)	An object crossing the field of view	Corridors, unoccupied rooms, server rooms	False positives from HVAC, cleaners, pets, sunlight
Sound detector	A characteristic sound, e.g. breaking glass	Glazed frontages, ground-floor windows	Noisy sites; no detection of quiet forced entry

Alongside the detectors, the guidance asks for conditions that are easy to check and often wrong in practice:

• Alarms should cover all external doors and windows, unoccupied areas and rooms holding critical equipment. The most common finding here is an unsurveilled secondary entrance, fire exit or goods door.
• The alarm control panel should sit inside an alarmed zone, so that reaching the panel trips the alarm.
• Detectors and the control panel should be tamper-proof, so interference is itself an event.
• Anyone who triggers an alarm should still have a safe, accessible exit — a security measure must not become a life-safety hazard.
• The design and operation of the ISO 27001 physical security monitoring system should be kept confidential and protected against being disabled remotely.

That last point is the one that catches technical teams. If an attacker can reach your camera management server, the control is gone before anyone reaches the door.

Monitoring is only half the control

A.7.4’s statement stops at “monitored”, and that is where most implementations stop too — a system is installed, it records, and nobody looks. ISO’s purpose for the control is to detect, and detection you never act on is not detection. NIST spells out the missing limbs explicitly, and PE-6 is the cleanest free template available for filling the gap in an ISO 27001 physical security monitoring design:

NIST SP 800-53 PE-6	Requirement	What it adds to A.7.4
PE-6a	Monitor physical access to detect and respond to physical security incidents	Names the response obligation A.7.4 only implies
PE-6b	Review physical access logs at a defined frequency and on defined events	Turns recording into an operated control
PE-6c	Coordinate review and investigation results with incident response	Connects physical detection to your IR process
PE-6(2)	Recognise defined intrusion classes and initiate defined automated responses	Makes alerting testable rather than aspirational
PE-6(4)	Monitor physical access to the system, not only the facility	Covers server rooms, media stores and comms rooms separately

PE-6’s discussion also supplies something no ISO document gives you: a description of what suspicious physical access actually looks like. NIST names accesses outside normal working hours, repeated accesses to areas not normally accessed, accesses lasting unusual lengths of time, and out-of-sequence accesses. Turn those four into detection rules and your review process has content rather than a calendar reminder:

• Out-of-hours badge use — alert on any credential read outside the holder’s normal pattern.
• First-time area access — alert when a credential is used in a zone it has never been used in before.
• Unusual dwell time — flag entries to a secure area with no matching exit, or an implausibly long stay.
• Out-of-sequence access — an exit with no entry, or two entries with no exit between them, is the signature of tailgating. Anti-passback in the PACS detects it automatically.

Those alerts have to land somewhere. Route ISO 27001 physical security monitoring alerts into the same process you already run for technical events — see our ISO 27001 incident response plan guide — because a physical alarm at 02:00 with no documented escalation path is a finding waiting to happen.

Your monitoring system is also an asset in scope

Here is the part almost every page on this control misses. A video monitoring system is not only how you satisfy A.7.4. It is an IP-connected system holding sensitive data, so it becomes an object of your other controls at the same moment it becomes a control itself. The EDPB’s technical breakdown of a video surveillance system — image capture, interconnections, image handling, data and activity management, and interfaces to other systems such as access control and fire alarm — maps almost one-to-one onto the Technological theme:

VSS component	Risk if unprotected	Annex A control that applies
Cameras and sensors (image capture)	Default credentials, unpatched firmware, physical tampering	A.8.8 vulnerability management, A.8.9 configuration management
Network links (interconnections)	Footage interception; camera VLAN bridged to the corporate network	A.8.20 networks security, A.8.22 segregation of networks
Recorder or VMS server (image handling)	Footage deleted or exported by an attacker; remote disabling	A.8.2 privileged access rights, A.8.13 information backup
Operator and administrator accounts	Unlogged viewing of staff; no accountability for exports	A.8.15 logging, A.5.15 access control
Monitoring service provider interface	Third-party access to live feeds with no contractual limits	A.5.19–A.5.22 supplier relationships

Treat the camera estate as a system of record. Put the VMS administrator accounts through the same regime as any other privileged account — our ISO 27001 privileged access guide covers the controls — and make sure footage access is captured in line with ISO 27001 logging requirements. Who watched what, and who exported it, is a question both auditors and data subjects can ask.

ISO 27001 physical security monitoring and data protection law

This is the risk that makes A.7.4 different from every other Annex A control. ISO 27001 physical security monitoring means processing personal data about identifiable people, including your own staff, in a context where they often cannot avoid being recorded. ISO/IEC 27002:2022 says as much: monitoring and recording mechanisms should be used with local laws and regulations in mind, including data protection and personal data protection legislation, and an impact assessment should be considered before CCTV is deployed.

For organisations in scope of the UK or EU GDPR, the authoritative free reference is the European Data Protection Board’s Guidelines 3/2019 on processing of personal data through video devices, adopted in final form on 29 January 2020. Five of its requirements attach directly to your implementation:

Obligation	What the EDPB says	Where it lands in your ISMS
Lawful basis	Video surveillance under Article 6(1)(f) is lawful only where it is necessary for a legitimate interest that is not overridden by the data subject’s interests, rights and freedoms	Documented balancing test, referenced from the SoA entry for A.7.4
DPIA	Mandatory under Article 35(3)(c) for systematic monitoring of a publicly accessible area on a large scale; the EDPB considers it reasonable to assume many video surveillance cases will need one	DPIA record, plus prior consultation with the regulator if high risk remains
Transparency	Two layers: a warning sign readable before entering the monitored area, roughly at eye level, plus fuller information available elsewhere. The sign must also disclose anything that would surprise the data subject, such as transmission to third parties outside the EU	Signage register — and the deterrent half of A.7.4 depends on it anyway
Retention	No fixed period, but footage should in most cases be erased, ideally automatically, after a few days; the longer the period, especially beyond 72 hours, the more justification is required	Retention configuration on the recorder, plus the written justification
Security of the footage	Article 32 applies to the surveillance data itself, and Article 25 requires data protection by design before collection begins	The Annex A controls in the table above

Note the direction of the retention argument. Most organisations set 30 or 90 days because that is the recorder’s default, then cannot explain why. The EDPB’s reasoning is that damage is usually noticed within a day or two, so a short period is the starting point and anything longer needs a stated reason — a closed weekend, a holiday shutdown, or live litigation. If you are documenting the assessment itself, our DPIA for CCTV guide walks through the template.

One more trap worth naming: a lawful basis for ISO 27001 physical security monitoring is not a lawful basis for performance monitoring. The moment footage is used to check whether someone arrived late, you are processing for a new purpose with a different balance, and the original justification does not carry over.

What ISO 27001 physical security monitoring evidence looks like

Because A.7.4 has no mandatory document, the audit turns on records rather than policy. Build the ISO 27001 physical security monitoring pack around six sets and an auditor can close the control in twenty minutes:

1. Coverage map. A floor plan or site list showing every entrance, window line, unoccupied area and equipment room, with the monitoring method assigned to each. Gaps are either justified or fixed; an unannotated gap reads as an oversight.
2. System records. Device inventory for cameras, detectors, panels and recorders; firmware levels; and the arm/disarm or uptime log that demonstrates the word “continuously”.
3. Review records. Dated evidence that someone looked — log reviews, alert triage notes, anti-passback exception reports. This is the limb that fails most often.
4. Response records. At least one worked example: an alarm or anomalous access, who was contacted, what was found, how it closed. A control that has never fired anything is a control nobody has tested.
5. Testing records. Evidence the detectors and the escalation path still work — a walk test, a deliberate activation agreed with the monitoring centre, a call-out drill.
6. Privacy records. Balancing test, DPIA where required, signage, retention setting and its justification, footage access log, and the processor contract if a provider is involved.

Where a landlord or building manager runs the cameras, you still own the control. What you hold instead is the agreement, the coverage confirmation and the process for requesting footage — treated as a supplier arrangement, not as an exemption.

ISO 27001 physical security monitoring for cloud-hosted teams

If your systems live in someone else’s data centre and your staff work from home, ISO 27001 physical security monitoring does not disappear — it moves.

Start with scope. The control applies to premises inside the boundary of your ISMS. For a cloud-hosted business that still has an office, the office is in scope even if no production system sits in it, because laptops, paper, whiteboards and network access do. Our guidance on the clean desk policy covers what is genuinely at risk in an ordinary office, and most of it is exactly what an intruder would take.

Then handle the data centre. Your provider’s monitoring is not your implementation of A.7.4; it is a supplier control you verify, normally through their ISO 27001 certificate scope or a SOC 2 Type II report — and specifically by checking that physical security monitoring appears in that scope rather than assuming it. Record the check, record its date, and repeat it when the report is reissued.

Finally, the genuinely premises-free case. An organisation with no premises in scope can exclude A.7.4 in the Statement of Applicability, but the justification has to be that there are no premises, not that ISO 27001 physical security monitoring is inconvenient. Expect the auditor to test it by asking where the company’s laptops are configured, where paper records are kept, and whether anyone has a home office holding equipment on behalf of the organisation. In practice very few organisations clear that bar.

Frequencies the standard never sets

This control attracts invented numbers more than most, so it is worth being blunt. ISO/IEC 27001:2022 states no frequency anywhere in A.7.4 — not for reviewing footage, not for testing detectors, not for reviewing the arrangement itself. ISO/IEC 27002:2022 does not supply one either. Published figures such as quarterly drills, weekly log sampling, annual policy review or 30-to-90-day retention are vendor conventions. They may be sensible, and you are free to adopt them, but they are your commitments rather than the standard’s requirements — and once written into your own procedure they become auditable against you.

The defensible approach is to derive each interval from risk and say so: review the access log weekly because the office is shared, walk-test the detectors twice a year because the landlord changed the layout, keep footage for 72 hours because that is what your incident pattern needs. A number with a reason behind it passes. A number copied from a blog does not.

Frequently asked questions

Is CCTV mandatory for ISO 27001?

No. A.7.4 requires continuous monitoring for unauthorised physical access; it does not name a technology. Guards, intruder alarms, access control logs and physical security information management software are all recognised options, used alone or together. For a small single-office organisation, an intruder alarm plus reviewed badge logs is often a stronger and cheaper form of ISO 27001 physical security monitoring than cameras, because it produces clean evidence with far less data protection overhead.

Can we exclude A.7.4 from our Statement of Applicability?

Only if the justification is genuine. If your ISMS scope includes any premises — an office, a storeroom, a comms cupboard — an auditor will expect ISO 27001 physical security monitoring to be applicable. Excluding it because your systems are cloud-hosted does not work, because the control is about premises rather than servers. Where the premises belong to a landlord or a colocation provider, the control stays applicable and is satisfied through the supplier arrangement.

How long should we keep CCTV footage?

ISO 27001 sets no period. Under the UK and EU GDPR, the European Data Protection Board’s position is that footage should in most cases be erased after a few days, ideally automatically, and that a period beyond 72 hours needs additional justification of why the purpose requires it. Set the shortest period that lets you detect and investigate the incidents you actually see, write down the reasoning, and configure the recorder to enforce it rather than relying on someone to delete.

Do we need a DPIA before installing cameras?

Often, yes. Article 35(3)(c) of the GDPR makes a DPIA mandatory for systematic monitoring of a publicly accessible area on a large scale, and the EDPB considers it reasonable to assume that many video surveillance deployments will require one. Even where it is not strictly mandatory, a short assessment is the cheapest way to produce the balancing test your A.7.4 evidence pack needs anyway. If the assessment shows high residual risk, Article 36 requires you to consult your supervisory authority before you start processing.

Do we need a physical security monitoring policy?

Not as a mandatory document — A.7.4 does not ask for documented information, and no such policy appears among ISO 27001’s required documents. In practice most organisations fold ISO 27001 physical security monitoring into a wider physical security policy, because the control involves several teams, often a third party, and a legal basis, and that is hard to run on memory. If you write one, keep it to what you will genuinely do: coverage, who reviews what and when, escalation, retention, and who may view footage.

Getting A.7.4 done without starting from a blank page

ISO 27001 physical security monitoring is a short control with a long tail: a coverage decision, a detection design, a review routine, an escalation path, and a privacy file that has to stand up on its own. None of it is difficult, but all of it has to exist before a stage 2 audit, and the parts that fail are almost always the records rather than the hardware.

If you would rather adapt than draft, the ISO 27001 Toolkit includes 165 editable templates covering the physical security controls alongside the full Annex A set, the Statement of Applicability and the risk documentation, for $149. It will not install your cameras, but it will give you the register, the policy and the review records an auditor asks for — and the ISO/IEC 27001:2022 standard itself remains the one document worth reading in the original before you commit to any of it.