Physical security monitoring

Plain-language summary

New in 2022: keeping a continuous watch over your premises for unauthorised physical access — through alarms, CCTV, guards or a monitored response service — and making sure someone sees the alert, acts on it, and can look back afterwards at what happened.

What the clause is really asking

Locks and fences delay intruders; monitoring tells you they are trying. This new control asks for continuous watch over your premises so that unauthorised entry is noticed, using whatever mix fits the risk: intruder alarms with motion and door sensors, CCTV, security guards, and alarm monitoring by a control room or armed response. The design questions are coverage (which perimeters and secure areas), who receives alerts and how fast they respond, protecting the system against tampering and power loss, and retention of and access to recordings. The misunderstanding is that cameras equal monitoring; a recorder nobody reviews, that overwrites in a week and sits in the room it records, protects very little. In South Africa, CCTV images of identifiable people are personal information under POPIA, so you need signage, a retention period and restricted access to footage; guarding providers must be registered with PSIRA; and alarms and cameras need battery or UPS backup to keep working through power outages. On many sites the guarding contract already sits with the SHEQ or facilities team; bring it into the ISMS.

What auditors look for

Auditors ask what monitoring covers each perimeter and secure area and then test it: they check an alarm zone triggers, look at camera views for blind spots and night-time image quality, and ask for footage from a specific past date to test retention. They ask who responds to an after-hours alarm and look at the response log and times. They check where the recorder sits and who can view, export or delete footage. They read the guarding contract and check PSIRA registration. The hard question: show me the last after-hours alarm, who responded, and how long it took.

Typical evidence

Monitoring design showing alarm zones and camera coverage of perimeters and secure areas; alarm monitoring and armed response contract; guard instructions and patrol records; alarm activation and response logs; CCTV retention settings and footage access log; alarm and camera maintenance and test records; POPIA CCTV notice and retention rule; guarding provider PSIRA registration; backup power for monitoring systems.

How to comply — recommendations

Start from your perimeter plan and mark what each zone needs: intruder alarm, camera, guard patrol or a combination. Connect alarms to a monitored control room with armed response and put response times in the contract. Place the CCTV recorder in a locked cabinet or secure room, or record offsite, and put it on UPS. Set a retention period you can justify, long enough to investigate an event discovered late, and restrict who can view or export footage. Put up POPIA-compliant signage. Test alarms quarterly, review the response log monthly, and check the guarding provider's PSIRA registration every year.

Common nonconformities

Secure areas without any monitoring; CCTV never reviewed, or recordings overwritten before incidents are noticed; recorder unprotected in the area it covers; no record of alarm response; alarms and cameras fail during power outages; footage open to anyone or kept indefinitely; no CCTV signage or retention rule; guarding provider registration never checked.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.