Key takeaways
- Monitor premises for unauthorised physical access.
- Monitoring premises deters and detects unauthorised physical access.
- Start here: decide what monitoring is needed: CCTV, alarms, guards.
Purpose
Monitor premises for unauthorised physical access.
Requirement
Requirement summaryPremises shall be continuously monitored for unauthorized physical access.
Why it matters
Monitoring premises deters and detects unauthorised physical access.
How to implement
- Decide what monitoring is needed: CCTV, alarms, guards.
- Respect privacy law when recording.
- Review alerts and footage when incidents occur.
- Test alarms periodically.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.4. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for monitoring premises (alarms, cameras, security staff).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.4 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Alarm and camera test or maintenance records.
- Records of how long footage is kept and who can view it.
Things you should be able to show or explain
- Be able to show monitoring equipment working and covering key areas.
How much to show: Each in-scope site.
Common mistakes
- Cameras broken or never checked.
- Alarm never tested.
- CCTV that has not recorded for months.
- No signage or privacy notice for cameras.
- Tip: CCTV and alarms, with someone actually reviewing alerts.
Policies & documents to have
- Physical Security Policy
- Third-Party Management Policy
FAQ
Is A.7.4 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.4?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for monitoring premises (alarms, cameras, security staff)…