ISO 27001 A.7.4: Physical security monitoring

Start with a risk assessment of your premises. Identify the most valuable assets, the highest-threat areas, and any regulatory requirements. Design your monitoring system to provide complete coverage of all critical areas.

Place CCTV cameras at every entry and exit point, along building perimeters, in corridors leading to restricted areas, inside restricted areas like server rooms, in parking areas, and at loading docks. Choose cameras with the right specs for each location - decent resolution, night vision for exterior or low-light areas, weather resistance for outdoor positions.

Deploy intrusion detection for areas that need protection outside business hours. Use a mix of door contacts, passive infrared motion detectors, glass break sensors, and vibration sensors as appropriate. Tune the system carefully - too sensitive and you drown in false alarms, too lax and you miss real events.

Set up a monitoring and response capability. If you run 24/7 operations, have a security operations centre or monitoring station watching feeds and responding to alarms in real time. If you do not have round-the-clock staff, outsource to a professional security monitoring company with agreed response times and escalation procedures.

Write clear response procedures for different alert types. An intrusion alarm at the server room is a very different situation from a motion alert in a general office at 3am. Document who gets called, how quickly, and what happens if the first responder does not pick up. Test these procedures regularly with drills.

Retain CCTV recordings for an appropriate period - typically 30 to 90 days depending on legal requirements and storage capacity. Store recordings securely with access limited to authorised personnel. Comply with data protection requirements: put up signage, run a DPIA if you have not already, and be ready to handle subject access requests for footage.

Test and maintain everything on a schedule. Check that cameras are working and coverage has no gaps. Test sensors. Verify that alarms actually reach the monitoring station and trigger a response. Replace broken components immediately. Update the system whenever the premises change.