  

## 7.4 Physical security monitoring

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|----------------------------|-----------------------------------------|---------------------------|-----------------------------|---------------------------|

| #Preventive #Detective | #Confidentiality #Integrity #Availability | #Protect #Detect | #Physical_security | #Protection #Defence |

  

**Control**

  

Premises should be continuously monitored for unauthorized physical access.

  

**Purpose**

  

To detect and deter unauthorized physical access.

  

**Guidance**

  

Physical premises should be monitored by surveillance systems, which can include guards, intruder alarms, video monitoring systems such as closed-circuit television and physical security information management software either managed internally or by a monitoring service provider.

  

Access to buildings that house critical systems should be continuously monitored to detect unauthorized access or suspicious behaviour by:

  

a\) installing video monitoring systems such as closed-circuit television to view and record access to sensitive areas within and outside an organization’s premises;

  

b\) installing, according to relevant applicable standards, and periodically testing contact, sound or motion detectors to trigger an intruder alarm such as:

  

1\) installing contact detectors that trigger an alarm when a contact is made or broken in any place where a contact can be made or broken (such as windows and doors and underneath objects) to be used as a panic alarm;

  

2\) motion detectors based on infra-red technology which trigger an alarm when an object passes through their field of view;

  

3\) installing sensors sensitive to the sound of breaking glass which can be used to trigger an alarm to alert security personnel;

  

c\) using those alarms to cover all external doors and accessible windows. Unoccupied areas should be alarmed at all times; cover should also be provided for other areas (e.g. computer or communications rooms).

  

The design of monitoring systems should be kept confidential because disclosure can facilitate undetected break-ins.

  

Monitoring systems should be protected from unauthorized access in order to prevent surveillance information, such as video feeds, from being accessed by unauthorized persons or systems being disabled remotely.

  

The alarm system control panel should be placed in an alarmed zone and, for safety alarms, in a place that allows an easy exit route for the person who sets the alarm. The control panel and the detectors should have tamperproof mechanisms. The system should regularly be tested to ensure that it is working as intended, particularly if its components are battery powered.

  

Any monitoring and recording mechanism should be used taking into consideration local laws and regulations including data protection and PII protection legislation, especially regarding the monitoring of personnel and recorded video retention periods.

  

**Other information**

No other information.