What it asks for. Premises should be watched continuously for unauthorised physical access. Monitoring can combine guards, intruder alarms, video surveillance and access control logs, chosen according to the sensitivity of each area.
In practice. Sensitive areas such as server rooms, network closets and secure offices have detection that someone actually responds to, whether that is a staffed security desk or an alarm receiving centre. Camera coverage and retention are designed against identified risks and checked against local privacy rules, which in Europe usually means a documented GDPR assessment and signage. Alarm systems are tested and maintained, and access logs are reviewed for anomalies. Evidence includes maintenance records, alarm response logs and a record of periodic reviews.
Common gaps. Cameras that record but are never reviewed, alarms with no defined response, and footage retained without a lawful basis are frequent findings. Co-located or outsourced facilities are often assumed to be monitored without anyone checking what the provider actually does.