PS-10 – Surveillance Cameras

What is this control about?

This is a must for physical office and data centers. Implementing “Surveillance Cameras” is crucial for enhancing the overall security and safety measures within an organization. This control involves the deployment of cameras strategically placed throughout the premises to monitor and record activities in various areas. Surveillance cameras offer a range of benefits that contribute to a comprehensive security strategy.

Available tools in the marketplace

Tools

CCTV Lorex Swann

Available templates

None, use the provided Physical Security Policy in your Trust Cloud Policy

Control implementation

In general, placing cameras at the entry and exit points should suffice. To fully implement this control, the following guidelines should be considered:

• Conduct Security Assessment: Begin by conducting a comprehensive security assessment to identify critical areas and vulnerable points within the organization. This assessment will help determine the optimal locations for placing surveillance cameras to maximize coverage and effectiveness.
• Define Surveillance Objectives: Clearly define the objectives of the surveillance system. Identify the areas that need continuous monitoring, such as entrances, exits, parking lots, server rooms, and other sensitive locations. Establish the specific security goals the surveillance cameras aim to achieve, such as crime prevention, incident detection, or safety monitoring.
• Select Appropriate Camera Types: Choose the appropriate types of surveillance cameras based on the identified objectives and the environment’s characteristics. Options include fixed cameras for static monitoring, pan-tilt-zoom (PTZ) cameras for versatile coverage, and infrared cameras for low-light or nighttime surveillance.
• Develop a Camera Placement Plan: Create a camera placement plan that considers angles, coverage, and potential blind spots. Ensure that cameras are strategically positioned to capture critical areas, maintain clear visibility, and adhere to privacy considerations.
• Determine Recording and Storage Requirements: Decide on the required recording and storage capabilities based on the surveillance objectives and the desired retention period for video footage. Select an appropriate storage solution, such as network video recorders (NVRs) or cloud-based storage, to accommodate the video data.
• Network Infrastructure Assessment: Assess the organization’s network infrastructure to ensure it can support the surveillance system. Verify that the network bandwidth and connectivity are adequate to handle the video streams from the cameras.
• Install and Configure Cameras: Install the surveillance cameras at the designated locations according to the camera placement plan. Configure the cameras to meet specific surveillance objectives, such as motion detection, resolution settings, and frame rates.
• Implement Monitoring and Alerting: Set up a central monitoring station or security operations center (SOC) to oversee the surveillance cameras. Implement alerting mechanisms to notify security personnel in real-time of any suspicious activities or security breaches.
• Ensure Secure Access Control: Secure access to the surveillance system by implementing robust access controls and authentication mechanisms. Limit access to authorized personnel only, and use strong passwords and two-factor authentication to prevent unauthorized access.
• Test and Optimize Performance: Conduct thorough testing and optimization of the surveillance system to ensure it operates as intended. Test camera angles, motion detection, and storage capacity to fine-tune the system for optimal performance.
• Train Security Personnel: Provide comprehensive training to security personnel responsible for monitoring the surveillance system. Train them in camera operation, incident response procedures, and how to effectively use video footage for investigations.
• Regular Maintenance and Review: Establish a maintenance schedule to ensure the surveillance cameras and associated infrastructure are in good working condition. Regularly review camera footage and incident reports to identify any system issues or areas for improvement.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action.

1. Screenshot of the cameras at key entry and exit points showing the date and time of the recording

Evidence example

For the suggested action, an example is provided below:

• Screenshot of the cameras at key entry and exit points showing the date and time of the recording

Screenshot source