[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-7-4":3},{"item":4,"lessons":16,"controls":34,"related":44},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-7-4","Annex A 7.4","Physical security monitoring",4,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Premises should be watched continuously for unauthorised physical access. Monitoring can combine guards, intruder alarms, video surveillance and access control logs, chosen according to the sensitivity of each area.\n\n**In practice.** Sensitive areas such as server rooms, network closets and secure offices have detection that someone actually responds to, whether that is a staffed security desk or an alarm receiving centre. Camera coverage and retention are designed against identified risks and checked against local privacy rules, which in Europe usually means a documented GDPR assessment and signage. Alarm systems are tested and maintained, and access logs are reviewed for anomalies. Evidence includes maintenance records, alarm response logs and a record of periodic reviews.\n\n**Common gaps.** Cameras that record but are never reviewed, alarms with no defined response, and footage retained without a lawful basis are frequent findings. Co-located or outsourced facilities are often assumed to be monitored without anyone checking what the provider actually does.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30],{"slug":19,"title":20,"published_at":21},"insider-threat-openai-employee-plants-audio-device-in-conference-room","Insider Threat: OpenAI Employee Plants Audio Device in Conference Room","2026-10-14T00:20:50.023+00:00",{"slug":23,"title":24,"published_at":25},"italian-dpa-fines-swimming-pool-operator-8000-for-unlawful-dressing-room-surveillance","Italian DPA Fines Swimming Pool Operator €8,000 for Unlawful Dressing Room Surveillance","2026-09-14T14:21:47.359+00:00",{"slug":27,"title":28,"published_at":29},"italian-sports-facility-fined-8000-for-unlawful-cctv-surveillance-of-pool-users","Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users","2026-09-14T14:21:29.034+00:00",{"slug":31,"title":32,"published_at":33},"german-court-upholds-8000-gdpr-fine-for-unlawful-employee-surveillance","German Court Upholds €8,000 GDPR Fine for Unlawful Employee Surveillance","2026-09-09T14:21:38.927+00:00",[35,40],{"slug":36,"name":37,"problem":38,"stories":39},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",1,{"slug":41,"name":42,"problem":43,"stories":39},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[45,51,55,59,64,68,73,78],{"family":46,"item":47,"code":48,"title":49,"together":50},"gdpr","6","Article 6","Lawfulness of processing",3,{"family":46,"item":52,"code":53,"title":54,"together":50},"35","Article 35","Data protection impact assessment",{"family":46,"item":56,"code":57,"title":58,"together":50},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":60,"item":61,"code":62,"title":63,"together":50},"cis","3","Control 3","Data Protection",{"family":46,"item":65,"code":66,"title":67,"together":50},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":69,"item":70,"code":71,"title":71,"together":72},"itil","overview","ITIL",2,{"family":74,"item":75,"code":76,"title":77,"together":72},"nist-800-53","ac-2","AC-2","Account Management",{"family":46,"item":79,"code":80,"title":81,"together":39},"30","Article 30","Records of processing activities"]