ISO 27001 Annex A 7.4 Continuous monitoring of physical access to premises
What it says
Premises shall be continuously monitored for unauthorized physical access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse systems like CCTV and alarms to detect unauthorised physical entry.
This control is about ensuring the security of your physical location, such as an office or warehouse, by keeping an eye out for people who shouldn't be there. If premises aren't monitored, unauthorised individuals might sneak in, potentially leading to theft, data breaches, or even harm to your employees.
Free. Save your status, tasks and notes.
Why it matters
Without continuous monitoring, intruders may enter undetected, steal assets, or access systems, causing financial loss and reputational harm.
How to implement
The office manager should arrange for the installation of surveillance systems like CCTV and alarms.
This involves reaching out to security companies to assess needs and install cameras and sensors at key access points such as entrances and windows.
Security personnel should be tasked with regularly checking the functionality of monitoring equipment.
They should test alarms and CCTV systems weekly to ensure they work correctly, and report any issues immediately for repair.
The IT manager should secure access to surveillance data.
They must set strong passwords and ensure only authorised personnel view video feeds, complying with the Privacy Act 1988 regarding personal information.
Facilities management should review and update the monitoring plan annually or after significant changes.
They should verify that all areas where sensitive activities occur, like server rooms, are covered, and make adjustments based on any operational changes.
The compliance officer should ensure all surveillance practices align with local laws.
They should consult guidance from the OAIC to maintain compliance with regulations on data use and retention, particularly concerning video footage.
Keep it running
Monitor CCTV/alarms continuously, alert on after-hours entry/door-forced events, and test response and escalation procedures regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The surveillance system installation report.
Look at
The installation date and locations covered. GOOD is having documentation showing that the system covers all critical entry points and sensitive areas.
- Check 2 of 5What an auditor asks for
Ask for
Maintenance logs of surveillance equipment.
Look at
The frequency and details of checks performed. GOOD is having logs indicating regular checks with actions taken to resolve issues quickly.
- Check 3 of 5What an auditor asks for
Ask for
The access control logs for surveillance data.
Look at
The list of authorised personnel and activity history. GOOD is that only authorised staff have accessed data, with no unexplained access incidents.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of compliance with privacy regulations.
Look at
The privacy policy documentation and data retention practices. GOOD is alignment with Australian privacy laws, including secure storage and proper handling of recorded footage.
- Check 5 of 5What an auditor asks for
Ask for
The monitoring plan and its review schedule.
Look at
The last update and any modifications. GOOD is having a recent, comprehensive plan that accurately reflects current personnel and facility layout.
Mappings
Closest match in ASD Information Security Manual: ISM-1053, Secure physical access for classified equipment, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-1053.
ISM-1053 requires classified servers, network devices and cryptographic equipment to be housed in secure rooms that meet security zone requirements aligned to classification. Annex A 7.4 requires continuous monitoring of premises for unauthorised physical access, which can be used to monitor access to those secure server/communications rooms (e.g., CCTV/alarms). The overlap is monitoring and detection for protected areas, but Annex A 7.4 is broader (whole premises) and ISM-1053 is focused on classification-appropriate secure zoning for specific equipment.
This control supports ISM-1973.
Annex A 7.4 requires premises to be continuously monitored to detect unauthorised physical access (e.g. CCTV, alarms, guard monitoring). ISM-1973 requires non-classified systems to be housed in suitably secure facilities, which provides the physical security baseline where continuous monitoring is typically applied. ISM-1973 focuses on the security of the facility environment, while Annex A 7.4 is specifically about ongoing detection/monitoring of unauthorised entry attempts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.