All 93 controls · Physical controls
Control 7.4
Physical security monitoring
What ISO/IEC 27002:2022 control 7.4 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Premises are to be watched continuously for unauthorized physical entry. Purpose: detect and discourage unauthorized physical access. Guidance: surveillance can combine guards, intruder alarms, CCTV and similar video systems, and physical security information management software, run in-house or by a monitoring provider. Buildings housing critical systems should be watched continuously for intrusion or suspicious behaviour by installing video systems that view and record entry to sensitive areas inside and outside the premises; by installing to applicable standards, and testing periodically, contact, sound or motion detectors that raise an intruder alarm, such as contact sensors on doors, windows or under objects usable as panic alarms, infrared motion sensors and glass-break sound sensors; and by covering all external doors and reachable windows with alarms, keeping unoccupied areas alarmed at all times and covering other areas such as computer and communications rooms. How the monitoring is laid out stays confidential, since knowing it helps intruders avoid detection, and the systems are protected so video feeds cannot be viewed by unauthorized people and the systems cannot be switched off remotely. The alarm control panel is placed inside an alarmed zone and, where it serves safety alarms, close to a clear exit for whoever sets it; panel and detectors are tamper-proof, and the system is tested regularly, especially battery-powered parts. Monitoring and recording must respect local law, including data protection rules on monitoring staff and on how long video is kept.
Purpose in the standard’s terms, in our words: Detects and deters unauthorized physical access.
Attribute values in one line: Preventive, Detective; Confidentiality, Integrity, Availability; Protect, Detect; Physical security; Protection, Defence.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | PreventiveDetective |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | ProtectDetect |
| Operational capabilities | Physical security |
| Security domains | ProtectionDefence |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Coverage plans for CCTV and intruder detection over sensitive areas, external doors, accessible windows and unoccupied zones
- Alarm and detector installation certificates to applicable standards and periodic test records, including battery-powered components
- Monitoring logs or monitoring-provider reports showing alarms raised and responses
- Access restrictions and hardening of CCTV and alarm systems, including protection of video feeds and remote management
- Evidence that the alarm panel is located in an alarmed zone with tamper protection
- A privacy or legal assessment covering staff monitoring and video retention periods
Where audits commonly find gaps
- CCTV records but nobody reviews footage or responds to alerts
- Detectors are installed but never tested, with flat batteries unnoticed
- Video systems are exposed on the network with default credentials
- Video is retained longer than local law permits
What ISO/IEC 27028 changes for this control
It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it. It serves more than one security domain, which is why a domain count taken by row understates the view.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.