ISO 27001:2022 Annex A Control 7.4

Guidance on How to Comply With ISO 27001:2022 Annex A 7.4

According to ISO 27001 Annex A Control 7.4, organisations must implement the following three steps to detect and deter unauthorised access to facilities that house critical information assets and prevent them from being compromised.

Put in Place a Video Monitoring System to Keep an Eye on the Situation

To continuously monitor access to restricted areas that host critical information assets, an organisation should have a video surveillance system, such as CCTV cameras. This is an example of such a system. Furthermore, it is also critical that this surveillance system keeps a record of all entries and exits on the premises.

Installing Detectors to Trigger an Alarm

The ability to trigger an alarm when an intruder enters the physical premises enables the security team to respond quickly to any security breach. It can also be an effective way of deterring intruders from entering your home.

It is recommended that organisations purchase motion, sound, and contact detectors that will alert them when abnormal activity is detected within the organisation’s physical premises.

This includes, but is not limited to:

• A contact detector should be installed in the environment. When an unknown object or individual gets in contact with a specific object or breaks contact with a certain object, an alarm should be activated. A contact detector can, for example, be configured to trigger an alarm when the contact detector contacts any window or door.
• The motion detectors can be configured to alert you if they detect movement within their range of view of an object moving in their range of vision.
• A sound detector, such as a break glass detector, can be activated when it detects a sound, which can help prevent car accidents.

Configuration of Alarms for All Internal Premises

It is imperative to ensure that the alarm system has been appropriately configured. This will ensure that all sensitive areas, including all external doors, windows, unoccupied areas, and computer rooms, are within the range of the alarm system. This will prevent any vulnerabilities from being exploited.

For example, intruders may use smoking areas or gym entrances as attack vectors if they are not monitored.

The Types of Surveillance Systems Available

Although ISO 27001 Annex A Control 7.4 does not mandate that organisations choose one surveillance system over another, it does list several surveillance tools that can be used separately or in combination with others, including:

• CCTV cameras.
• Security guards.
• Intruder alarm systems.
• Physical security management software.

ISO 27001:2022 Annex A 7.4 Supplementary Guidance

The following considerations should be considered when implementing physical security monitoring systems as per Annex A Control 7.4:

• Maintaining confidentiality about the design and inner workings of monitoring systems is essential.
• To eliminate the risk of remote disabling of monitoring systems by malicious parties, appropriate measures should be implemented. These measures should be implemented to prevent the disclosure of monitoring activities, and video feeds to unauthorised parties.
• It is essential that the alarm control panel be located in an alarm-equipped area. In addition, it is essential that the person who triggers the alarm has safe and easy access to exit the area.
• A tamper-proof detector and an alarm control panel should be used.
• Individuals should be monitored and recorded using surveillance systems only for legitimate purposes. This monitoring and recording should comply with all applicable laws and regulations, including data protection laws. For example, the EU and UK GDPR may require organisations to conduct an impact assessment before deploying CCTV cameras. Moreover, the recording of video feeds should adhere to the data retention periods established by applicable local laws.

What Are the Changes From ISO 27001:2013?

It is pertinent to note that control 7.4 is a brand-new Annex A control not addressed in ISO 27001:2013.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

The Benefits of ISMS.online

ISMS.online offers a wide range of powerful tools that simplify implementing, maintaining, and improving your information security management system (ISMS) to meet ISO 27001 compliance requirements.

In addition to providing comprehensive tools, ISMS.online enables you to create bespoke policies and procedures tailored to your organisation’s risks and requirements. It also allows collaboration between colleagues and external partners such as suppliers or third-party auditors.

Get in touch today to book a demo.