Premises are to be watched continuously for unauthorized physical entry. Purpose: detect and discourage unauthorized physical access. Guidance: surveillance can combine guards, intruder alarms, CCTV and similar video systems, and physical security information management software, run in-house or by a monitoring provider. Buildings housing critical systems should be watched continuously for intrusion or suspicious behaviour by installing video systems that view and record entry to sensitive areas inside and outside the premises; by installing to applicable standards, and testing periodically, contact, sound or motion detectors that raise an intruder alarm, such as contact sensors on doors, windows or under objects usable as panic alarms, infrared motion sensors and glass-break sound sensors; and by covering all external doors and reachable windows with alarms, keeping unoccupied areas alarmed at all times and covering other areas such as computer and communications rooms. How the monitoring is laid out stays confidential, since knowing it helps intruders avoid detection, and the systems are protected so video feeds cannot be viewed by unauthorized people and the systems cannot be switched off remotely. The alarm control panel is placed inside an alarmed zone and, where it serves safety alarms, close to a clear exit for whoever sets it; panel and detectors are tamper-proof, and the system is tested regularly, especially battery-powered parts. Monitoring and recording must respect local law, including data protection rules on monitoring staff and on how long video is kept.
This control maps to 53 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 7.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.