A.7.4 Physical security monitoring: requirements and evidence

What A.7.4 physical security monitoring asks for in ISO 27001

A.7.4 requires that premises are continuously monitored for unauthorized physical access, so that such access is detected and deterred. It is one of the controls that is new in the 2022 revision of Annex A, with no counterpart in the 2013 edition, so an organization that certified under the earlier edition has to add it to its Statement of Applicability and show how it operates. When an auditor or customer asks how premises are watched, they want to see a monitoring capability that runs at all hours, covers the areas where information and equipment sit, and produces records someone reviews. A guard, an alarm panel or a camera on its own does not meet the control. The question is whether an unauthorized entry would be seen, logged and acted on. The difficulty is joining the parts. Guards patrol, intruder alarms trigger and cameras record, but each can run in isolation. An auditor will look for the links: which alarm zones match the secure areas defined under A.7.1 and A.7.2, who receives an alert and how quickly, whether camera coverage reaches the entry points and server rooms, and whether recordings are retained long enough to be reviewed after an incident. The organization should confirm the retention period and review frequency in its own risk assessment, and should be able to show alarm test results, guard tour logs, and records of alerts followed up with a documented outcome. A.7.4 is the physical counterpart of A.8.16 Monitoring activities, which covers the monitoring of networks, systems and applications. A.7.1 sets the perimeter and A.7.2 governs who passes through entry points, while A.7.4 watches what happens across those boundaries and records it. The practical check is to walk each secure area and ask three questions: could an unauthorized entry happen without an alert, would the alert reach a responder, and could the organization prove both afterwards from its records. The answers determine which evidence to prepare before an assessment.

Which sites, systems and third parties fall under A.7.4

Monitoring under A.7.4 only covers the premises you decide are in scope, so the scope decision comes first. The cards below cover the sites, hosted facilities and outsourced parties that most often change what must be monitored and what evidence must exist. Each decision should be traceable to the Statement of Applicability.

Premises holding information processing facilities

Start with every location that houses servers, network closets, backup media, or secure areas where information is handled. Each of these needs monitoring that covers its entry points, not only the building perimeter. Map each site to the assets it holds and record the monitoring method in use, such as guards, intruder alarms, or video. Check that the list matches the asset inventory, since a forgotten comms room is a common gap an auditor will find by walking the site.

Data centers and colocation providers

When your equipment sits in a colocation facility, the provider's monitoring covers much of the physical risk, but it does not cover your obligations. Ask the provider for its current certification scope and monitoring procedures, and confirm whether your cages, racks, or suites are included in its controls. Record in the Statement of Applicability whether you rely on the provider's monitoring and how you review its evidence. Treat the provider's reports as inputs to your own assessment, not as a replacement for it.

Outsourced guard and alarm monitoring companies

Contracted guard firms and remote alarm monitoring centers act on your behalf, so their performance becomes part of your control. Confirm in writing what they watch, how quickly they respond to alarms, how they log events, and how they report unauthorized access to you. Keep the contract terms, shift logs, and response records as evidence. Define who inside your organization receives alerts and who can act on them, and test that path before the audit.

Remote and shared office sites

Shared workspaces, coworking desks, and home offices can hold sensitive work without any monitoring you control. Decide whether these locations are in scope based on what information is handled there and whether they hold equipment. Where you exclude them, the reason must rest on a documented risk assessment, such as no information stored and no secure area present. Where you include them, agree in writing with the operator what monitoring the landlord or host provides and how you obtain its records.

Recording the decision in the Statement of Applicability

The Statement of Applicability states whether A.7.4 applies and how it is implemented. For each in-scope site, record the monitoring method, the responsible party, and where the records are kept. An exclusion is only defensible when it is justified: name the control, the site or system excluded, and the reason, such as a documented risk assessment showing no secure area or information present. Auditors will test whether exclusions match what they observe on site, so keep the justification current when sites change.

Verifying the scope before the assessment

Before an auditor arrives, walk every site on the scope list and compare it with the asset inventory and the Statement of Applicability. Confirm that each monitoring provider's records can be produced on request and that the dates cover the review period. Look for sites that were added, closed, or moved since the last assessment. Ask your implementation partner or internal team to prepare a short scope reconciliation, and ask the certification body to confirm which of your sites it will sample.

How an assessor tests physical security monitoring

This table sets out each step an assessor takes to test A.7.4, what they compare it against, the evidence they request and the findings they commonly raise. Read it as a checklist of what your monitoring records must prove, since an assessor will look for gaps between the site plan, the camera and alarm coverage, and what staff actually do when an alarm fires.

Test step	What the assessor checks	Evidence requested	Common finding
Walk the premises	Compares physical coverage with the site plan, including perimeter, entrances, loading bays, server rooms and secure areas	Current site plan, floor plans and a monitoring coverage map	Blind spots such as side doors, stairwells or rear service corridors with no camera or sensor
Sample camera zones	Selects several camera zones and checks field of view, image quality, lighting and whether monitored areas match the documented scope	Camera inventory, zone list, sample live and recorded images	Cameras obscured by fixtures, poor night image quality or zones missing from the inventory
Test footage retention	Requests footage for a sampled date and checks it exists, is complete and covers the retention period the organization set	Retention policy, recording system settings, retrieval log for a sampled event	Footage overwritten sooner than the documented retention period, or recorders with gaps
Review intruder alarm testing	Checks that alarm zones were tested on a schedule and that faults were fixed	Alarm test records, maintenance tickets, sensor fault reports	Alarms never tested since installation or test results with no follow-up
Examine alarm event history	Reviews a sample of alarm events and traces each one to a recorded response and closure	Alarm event log, response records, incident tickets	Alarm events cleared without investigation or no record of who responded
Review guard logs and patrol records	Compares patrol routes and times against the documented schedule and checks that exceptions were recorded	Patrol schedules, signed guard logs, handover notes	Patrols logged as complete with identical times, or missed rounds with no explanation
Check monitoring reviews	Looks for evidence that someone reviews camera, alarm and guard records on a defined frequency	Review sign-offs, exception reports, periodic review minutes	Monitoring logs collected but never reviewed by an accountable person
Interview staff	Asks staff what happens when an alarm fires, who responds, how quickly and how the event is escalated	Response procedure, contact lists, staff acknowledgement records	Responders describe different steps, or no one can name the escalation route

Steps to put continuous monitoring in place

The sequence below turns the A.7.4 requirement for continuous premises monitoring into a documented, tested and reviewed monitoring arrangement. Each step produces an artifact that an auditor can read, sample and trace back to the risk assessment.

Map premises and entry points to the risk assessment
Start from the risk assessment that already covers the organization's sites and information assets. List every building, floor, room and entry point that gives access to areas holding sensitive information or equipment, including loading bays, service corridors, roof access and remote or shared sites. Assign each area a risk rating from the existing assessment. The output is a coverage map that shows each zone, its entry points and its risk rating, signed off by the person who owns physical security. Confirm with the site owner whether any entry points sit outside the organization's control, such as shared lobbies, because these affect what monitoring can be proven.
Select monitoring methods for each zone
For each zone on the coverage map, decide which combination of guards, intruder alarms and video surveillance fits the risk and the way the site operates. Higher-risk zones usually justify layered methods, while lower-risk zones may need only alarms or periodic patrols. Record the decision and the reason for it in a monitoring standard, including who watches each feed, where cameras point, and which doors or windows trigger alarms. If guards are contracted, the agreement should specify the duties, reporting format and the records the provider must keep. The output is an approved monitoring standard that maps each zone to its methods.
Define retention and review rules for monitoring records
Decide how long alarm logs, video footage, guard patrol records and visitor-related monitoring data are kept, who may access them, and how access is logged. Retention periods should reflect legal, contractual and risk requirements, and the organization should confirm them with its legal or privacy function, particularly where video recording of people is involved. Define how often someone other than the operator reviews the records and what counts as an event that needs follow-up. The output is a retention and review schedule that names owners and states where records are stored and how they are protected from alteration.
Set alarm and incident response procedures
Write the procedure that runs from the moment an alarm or camera event is raised to its closure. It should name who receives the alert, how the operator confirms whether access was unauthorized, when local staff or security are dispatched, when police or the landlord are contacted, and how the event is logged and escalated to the incident management process. Include false alarm handling so that repeated nuisance triggers are investigated rather than ignored. The output is an approved response procedure with a sample incident record that shows each step completed for a test event.
Test coverage and tune the monitoring
Test each zone against its stated methods. Walk the perimeter at night and during business hours, trigger a door or window sensor, check that camera fields of view cover the entry points on the coverage map, and confirm that alerts reach the people named in the procedure. Record blind spots, poor image quality, delayed alerts and missed patrols, then adjust camera positions, sensor sensitivity or staffing. Repeat the test after changes. The output is a signed test record for each zone that lists the tests run, the results, the defects found and the corrective actions with owners.
Schedule recurring reviews and keep the evidence current
Set a recurring schedule for reviewing the monitoring standard, the coverage map, the retention rules and the test records. Review sooner when a site changes, a new entry point is added, an incident occurs or the risk assessment is updated. Keep the review outputs in the same management system records used for other Annex A controls so that an auditor can trace each change to a decision. Ask the certification body how it expects periodic review evidence to be presented, because this varies with scope and sampling. The output is a review log with dated entries, reviewer names and linked changes to the coverage map and procedures.

Monitoring records an auditor expects to see

An auditor testing A.7.4 wants proof that premises are watched, that alarms and footage are actually acted on, and that the monitoring setup is reviewed when the site changes. The cards below cover the artifacts that show this, and the routines that keep each one current between audits.

Site coverage maps

A current floor plan or site drawing marking every entry point, perimeter boundary, secure area and camera field of view, with each zone tied to an intruder sensor or guard post. Auditors compare the map against the building in person, so gaps such as a rear loading door or a stairwell without a camera are found quickly. Keep the map dated and version it. Review it after any refit, new tenant, relocated rack or change to a secure area, and record that review.

Camera and alarm inventories

A register listing every camera, intruder sensor, door contact and alarm panel with its location, model, firmware version, owner and status. The inventory should match what is physically installed and what the monitoring system reports as online. Unregistered devices are a common finding. Reconcile the inventory against the monitoring platform's device list at a set interval, and log each device added, moved or retired.

CCTV retention and footage exports

Document the retention period configured on each recorder and the justification for it, then keep a sample of footage exports showing that recordings exist for the stated period and can be retrieved. Confirm that time sync is correct across devices, since footage with wrong timestamps weakens any incident reconstruction. Exports used in investigations should carry a chain-of-custody record. Check retention settings after every firmware update, because updates can reset them.

Alarm event logs and response records

Exported logs of intrusion and door alarms, showing time, zone, the device that fired, who acknowledged it and what action followed. Auditors sample alarms and trace each one to a response, such as a guard dispatch, a cleared false alarm with a reason, or an escalation to the security lead. An alarm with no acknowledgement is a finding. Confirm the platform retains these logs long enough to cover your audit period and that they cannot be edited by operators.

Guard patrol and shift logs

Where guards are used, patrol records and shift handover notes showing the route, checkpoints visited, times and any anomalies found. Logs signed or scanned at checkpoints are stronger than free-text entries. Check that contracted guard firms supply these logs to you on a schedule and that exceptions, such as a missed patrol, were escalated. Keep the contract clauses that require this reporting, since they show the control is designed as well as operated.

Maintenance, test and review sign-offs

Records of periodic functional tests of alarms, door contacts and cameras, maintenance visits by the vendor, and a documented management review of monitoring effectiveness. A test record should name the device, the test performed, the result and the tester. The review sign-off confirms that someone accountable looked at coverage, alarm trends and open defects. Schedule these reviews in advance and keep the calendar entries as proof they were planned, not created retrospectively.

What meeting A.7.4 costs in money and effort

This table breaks down the cost components of meeting A.7.4 Physical security monitoring, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request, since no supplied figures set prices or durations for these components.

Cost component	Who is paid	One-time or recurring	What drives it
Camera and intruder alarm hardware	Equipment supplier and installer	One-time, with replacement cycles	Number of entry points, camera density, blind spots at perimeter and doors
Monitoring service contract	Alarm monitoring or security operations provider	Recurring	Number of sites, alarm zones, response requirements written into the contract
Guard staffing	Security guard company or internal staff	Recurring	Guard hours per site, round frequency, out-of-hours coverage, number of sites
Video storage for retention	Cloud provider or on-premises storage vendor	Recurring, scales with retention	Camera count, resolution, frame rate, retention length set by policy
Engineering time to link alarms with logging	Internal engineers or implementation partner	One-time integration, then periodic upkeep	Number of alarm and camera systems, log formats, whether events reach a central log store
Evidence upkeep	Internal compliance or security staff	Recurring	Frequency of access-review samples, log review cadence, number of sites in the audit sample
External review of monitoring coverage	Independent tester, auditor or consultant	Periodic, per scope agreed in writing	Size of the site estate, whether coverage is tested physically, how many scenarios are covered
Ask in every quote	Each bidder	Itemize one-time and recurring	Request line items for hardware, monitoring hours, retention terms, integration days and review scope

Who owns monitoring, who prepares evidence, and who assesses it

The organization owns control A.7.4 in full. It decides which premises need continuous monitoring based on its risk assessment, holds the contracts with guarding and alarm monitoring providers, and is accountable for what happens when an intrusion is detected or missed. The Statement of Applicability and the monitoring procedure are its documents, and staff must be able to explain them to an assessor without a consultant in the room.

Scope decisions: Name each site, secure area and entry point that is monitored, and record why any area is left out.
Service contracts: Hold the guarding, intruder alarm and video surveillance contracts, including response times, retention periods and who may access footage.
Alarm and camera ownership: Assign a named owner for each system, with responsibility for alerts, faults and maintenance.
Response accountability: Define who reviews alarms and footage, who escalates suspected unauthorized access and how incidents are logged.
Management review: Confirm the monitoring arrangements at planned reviews and record decisions.

Before engaging any outside party, confirm that your own staff can walk an assessor through each monitored area and its records.

Where physical monitoring evidence usually falls short

Most monitoring failures under A.7.4 are not failures to watch. They are gaps in the records that prove watching happened, who looked, and what followed. The six gaps below recur across sites and contractors, and each has a closing action an assessor can verify.

Cameras without documented coverage

A camera network often grows site by site, and nobody maintains a map of which doors, corridors, loading bays and secure rooms each camera covers. An assessor who asks where monitoring reaches cannot be answered from memory. Keep a current coverage plan showing camera positions, fields of view and the secure areas each one watches, and check it against a physical walk-through. Any blind spot should be either closed or recorded as an accepted risk.

Footage kept shorter than the review window

Monitoring only detects intrusions if footage exists when someone looks for it. Many systems overwrite recordings on a default cycle that is shorter than the time it takes to notice an event, especially for weekend or night incidents. Set retention from the organization's own review and incident timelines, not the vendor default, and test a restore of footage from a past date. Document the retention period and where the setting is enforced.

Alarms that are never tested

Intruder alarms and door contacts can fail silently through dead batteries, disconnected sensors or changed schedules. An alarm that has never been triggered in a test gives no assurance that it would reach anyone. Schedule periodic functional tests for each zone, record the date, tester, zone and result, and log every failed test as a finding with a fix date. Ask the alarm provider to show the test history for the last audit period.

Guard logs without supervisor review

Guard patrol logs and gate records show that someone was present, but they only deter and detect if a supervisor reads them. Logs filled in at the end of a shift and never reviewed are a common finding because they look complete while providing no oversight. Require a named supervisor to review and sign off logs at a defined interval, and sample entries against CCTV or access records to check that the patrols happened as written.

Monitoring not linked to the incident process

An alert that is raised but never routed to a responder is not monitoring in any practical sense. Auditors look for a documented path from a detected intrusion or alarm to triage, escalation, investigation and, where relevant, reporting to the information security incident process. Confirm that alarm and camera events feed the same ticketing or incident queue used for other security events, and keep examples of closed alerts with their outcome.

Records split across contractors

Guarding, alarm monitoring and maintenance are often outsourced, and each contractor keeps its own logs in its own system. When the organization cannot retrieve those records during an audit, the monitoring control appears to have no evidence at all. Write retrieval, format and retention requirements into each contract, require periodic copies of key records, and confirm that the organization can produce a complete timeline for any site and date range.

Questions buyers ask about A.7.4 monitoring

How much effort does A.7.4 physical security monitoring take to prepare?

Effort depends mostly on how many sites, entry points and monitored areas are in scope, and on whether monitoring systems already exist and produce records. A single office with an alarm contract and a camera system that keeps footage is a small evidence exercise. A multi-site estate with guard rounds, intruder alarms in several buildings and video that nobody reviews is a much larger one. The work falls into three parts: confirming what is monitored, showing the monitoring runs in practice, and keeping records that prove it. Ask any provider to estimate effort from a written scope of sites and systems rather than from a headline figure.

Can our in-house team handle A.7.4 monitoring without outside help?

Often yes, if someone owns the physical security controls and has time to produce evidence. Facilities and security staff usually already run the alarms, guards and cameras, so the gap is typically documentation: a defined monitoring scope, responsibilities, review of alarm and camera records, and a way to show that alerts were acted on. Outside help becomes more useful when the monitoring is run by several contractors, when records are scattered across vendor portals, or when no one has tested whether the controls work. Your team remains responsible for the control either way.

What does A.7.4 need from facilities and security staff day to day?

The control needs people who do the monitoring and people who can prove it happened. In practice, that means:

Named owners for each monitored area, guard post or alarm zone
Documented patrol or review routines, with records of what was checked and when
Procedures for responding to alarms and camera alerts, including escalation
Retention of alarm logs, visitor records and video according to your policy

Facilities staff also need to report faults, such as offline cameras or disabled sensors, so the gap is recorded and fixed rather than discovered at audit.

How long does preparing for A.7.4 take in general terms?

Preparation time is driven by how far current monitoring is from being documented and evidenced. Mature sites with working alarms, guards and video need mainly to define scope, write procedures and collect a sample of records. Sites that rely on informal practice need to design the routines first, run them for a period, and then review the results. Your readiness plan should follow the audit cycle your certification body applies. Ask any partner for a schedule based on your written scope and current evidence, and check whether the schedule includes time for an internal review before the external audit.

Can a consultant or implementation partner replace the ISO 27001 auditor?

No. An implementation partner can help define the control, prepare procedures, set up monitoring records and run an internal readiness review. Only an accredited certification body can audit your ISMS and issue a certificate, and that body must be independent of the firm that helped you prepare. Under ISO/IEC 17021-1, a certification cycle includes at least one audit in each calendar year, so the external audits remain necessary after the preparation work is finished. Ask any provider to state in writing which deliverables are preparation and which are the auditor's role.

Which records should we expect an auditor to ask for under A.7.4?

Auditors usually look for evidence that monitoring operated over time, not only that it exists. Typical records include the monitoring scope and site list, guard patrol logs or review sign-offs, intruder alarm event logs with the response taken, video retention settings and samples of footage review, maintenance and fault records for sensors and cameras, and any incident reports arising from monitoring. Confirm with your certification body which sample periods and formats it expects, since these depend on the audit plan.

How does A.7.4 relate to the logical monitoring control A.8.16?

A.7.4 covers monitoring of premises for unauthorized physical access, through guards, intruder alarms and video. A.8.16 covers monitoring of networks, systems and applications for anomalous behavior. Both are monitoring controls, and some organizations run them through one review process with separate evidence. Keep the physical and logical records distinct in your evidence set so an auditor can trace each control to its own operating records. Your scope statement should show which sites and systems each control covers.

How DeployOpen prepares physical monitoring evidence

DeployOpen works on A.7.4 Physical security monitoring as part of a wider effort to prepare systems and evidence for an ISO/IEC 27001 assessment. The organization keeps ownership of its guards, alarms, cameras and monitoring decisions, while DeployOpen prepares the platform records and documentation that show the monitoring operates. Only an independent auditor or certification body can issue a certificate.

How we scope

Agree in writing which sites, monitoring systems and secure areas fall within the A.7.4 scope.
Confirm which alarm, video and access event sources must feed the monitoring records.
Define who reviews alerts, how often, and which records the organization must retain.

How we build

Configure self-hosted open-source platforms in the client's own infrastructure to collect and timestamp monitoring events.
Set up alert routing so unauthorized access events reach a named owner with a documented response path.
Test the monitoring pipeline with controlled events and record the results for later review.

How we hand over

Deliver written documentation of the monitoring design, data sources, alert rules and retention settings.
Provide sample monitoring records and review logs in the format an auditor is likely to request.
Walk the organization's staff through the evidence set so they can produce it themselves.

How we support

Offer ongoing support, upgrades and continuous testing of the monitoring platform as a retainer.
Review monitoring records periodically and update alert rules when sites or systems change.
Confirm with the organization's certification body which evidence it expects before the audit.