ISO 27001:2022 Annex A 7.4 – Physical Security Monitoring

Strengthening Physical Security with ISO 27001:2022 Compliance

In the event that unauthorised access is granted to restricted physical areas such as server rooms and IT equipment rooms, information assets may be compromised in terms of confidentiality, availability, integrity, and security.

In ISO 27001:2022 Annex A 7.4, intruders are prevented from entering sensitive physical premises without authorisation.

The Purpose of ISO 27001:2022 Annex A 7.4?

Annex A Control 7.4 requires organisations to implement appropriate surveillance tools. This is to detect and prevent external and internal intruders from entering restricted physical areas without permission.

Surveillance tools capable of monitoring and recording access-restricted areas protect against risks resulting from unauthorised access to restricted areas, including but not limited to:

• Data theft.
• The loss of information assets.
• Financial damage.
• Removal of removable media assets for malicious purposes.
• Malware infection of IT assets.
• Attacks are carried out by an intruder using ransomware.

Who Has Ownership of Annex A 7.4?

According to ISO 27001 Annex A Control 7.4, compliance with this control requires the identification of all restricted areas. It also requires the identification of surveillance tools suitable for the specific physical area to be monitored.

Therefore, the chief security officer must be accountable for the implementation, maintenance, management, and review of surveillance systems in an effective manner.

Guidance on How to Comply With ISO 27001:2022 Annex A 7.4

According to ISO 27001 Annex A Control 7.4, organisations must implement the following three steps to detect and deter unauthorised access to facilities that house critical information assets and prevent them from being compromised.

Put in Place a Video Monitoring System to Keep an Eye on the Situation

To continuously monitor access to restricted areas that host critical information assets, an organisation should have a video surveillance system, such as CCTV cameras. This is an example of such a system. Furthermore, it is also critical that this surveillance system keeps a record of all entries and exits on the premises.

Installing Detectors to Trigger an Alarm

The ability to trigger an alarm when an intruder enters the physical premises enables the security team to respond quickly to any security breach. It can also be an effective way of deterring intruders from entering your home.

It is recommended that organisations purchase motion, sound, and contact detectors that will alert them when abnormal activity is detected within the organisation’s physical premises.

This includes, but is not limited to:

• A contact detector should be installed in the environment. When an unknown object or individual gets in contact with a specific object or breaks contact with a certain object, an alarm should be activated. A contact detector can, for example, be configured to trigger an alarm when the contact detector contacts any window or door.
• The motion detectors can be configured to alert you if they detect movement within their range of view of an object moving in their range of vision.
• A sound detector, such as a break glass detector, can be activated when it detects a sound, which can help prevent car accidents.

Configuration of Alarms for All Internal Premises

It is imperative to ensure that the alarm system has been appropriately configured. This will ensure that all sensitive areas, including all external doors, windows, unoccupied areas, and computer rooms, are within the range of the alarm system. This will prevent any vulnerabilities from being exploited.

For example, intruders may use smoking areas or gym entrances as attack vectors if they are not monitored.

The Types of Surveillance Systems Available

Although ISO 27001 Annex A Control 7.4 does not mandate that organisations choose one surveillance system over another, it does list several surveillance tools that can be used separately or in combination with others, including:

• CCTV cameras.
• Security guards.
• Intruder alarm systems.
• Physical security management software.

ISO 27001:2022 Annex A 7.4 Supplementary Guidance

The following considerations should be considered when implementing physical security monitoring systems as per Annex A Control 7.4:

• Maintaining confidentiality about the design and inner workings of monitoring systems is essential.
• To eliminate the risk of remote disabling of monitoring systems by malicious parties, appropriate measures should be implemented. These measures should be implemented to prevent the disclosure of monitoring activities, and video feeds to unauthorised parties.
• It is essential that the alarm control panel be located in an alarm-equipped area. In addition, it is essential that the person who triggers the alarm has safe and easy access to exit the area.
• A tamper-proof detector and an alarm control panel should be used.
• Individuals should be monitored and recorded using surveillance systems only for legitimate purposes. This monitoring and recording should comply with all applicable laws and regulations, including data protection laws. For example, the EU and UK GDPR may require organisations to conduct an impact assessment before deploying CCTV cameras. Moreover, the recording of video feeds should adhere to the data retention periods established by applicable local laws.

What Are the Changes From ISO 27001:2013?

It is pertinent to note that control 7.4 is a brand-new Annex A control not addressed in ISO 27001:2013.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

The Benefits of ISMS.online

ISMS.online offers a wide range of powerful tools that simplify implementing, maintaining, and improving your information security management system (ISMS) to meet ISO 27001 compliance requirements.

In addition to providing comprehensive tools, ISMS.online enables you to create bespoke policies and procedures tailored to your organisation’s risks and requirements. It also allows collaboration between colleagues and external partners such as suppliers or third-party auditors.

Get in touch today to book a demo.