Modern systems (high definition, powerful lenses, online sharing) can be very intrusive, so the organisation should first consider achieving its aim by less privacy-intrusive means (lighting, fencing, regeneration of a disused space) and use surveillance only as a necessary and proportionate response. Fixed and mobile cameras should focus on the relevant space and restrict wider views that are unnecessary (a café camera that sees into a neighbouring flat should be re-aimed). It should assess the impact on people's rights, clearly document and justify its lawful basis before deploying, and do a DPIA where high risk is likely.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.