In short

For a control room, NOC, or SOC, compliance is not a box ticked at the end of procurement. It is the constraint that decides which vendors can even bid. A video wall that fails the regulatory review is not a video wall the buyer can install, regardless of price or features. This article maps the regulatory frames that actually shape control-room video wall procurement — by jurisdiction — and how each one constrains the architecture.

Why compliance leads the procurement

A boardroom display has almost no compliance surface. A control-room video wall has a large one, because it carries operational data that regulators classify and protect: live camera feeds (personal data), critical-infrastructure telemetry, security events, network state that reveals customer impact. The wall is not a passive screen — it is an information-processing system, and the regulator treats it as one.

The practical consequence: write the compliance requirements into the tender first, then evaluate vendors against them. A bake-off that ranks vendors on features and discovers the compliance gap afterward wastes everyone's time.

Russia — Минцифры registry and FZ-187

Two frames dominate Russian control-room procurement:

Минцифры registry of Russian software. State operators and many state-adjacent buyers are required to procure from the registry of domestic software. A non-Russian vendor is excluded from these tenders by definition — this is why Polywall and other registry-listed RU vendors win state procurements that Western stacks cannot enter.
FZ-187 — critical information infrastructure. Systems in energy, transport, finance, healthcare, communications and other listed sectors fall under it, whether a company or a state body runs them. The law and its implementing rules are commonly interpreted as requiring the operational layer to stay in-country and, for the higher significance categories, often air-gapped, so a cloud-dependent video wall rarely passes review for these buyers — see the hybrid cloud architecture article for the on-prem requirement.

FZ-152 (personal-data localisation) also applies wherever camera feeds capture identifiable individuals — the data must be processed on servers inside Russia.

European Union — GDPR, BSI C5, ANSSI

GDPR. Live camera feeds containing identifiable people are personal data under Article 4(1). The wall processes that data; processing it through a control plane outside the EU, or one operated by a provider subject to the US CLOUD Act, requires a documented transfer mechanism and risk assessment (for US providers, the EU–US Data Privacy Framework or standard contractual clauses), which many facilities prefer not to take on. The clean answer is on-prem processing with no third-country data path.
BSI C5 (Germany). The German federal Cloud Computing Compliance Criteria Catalogue sets the cloud-security bar for public-sector procurement. General-purpose SaaS control planes rarely meet it, which pushes German government control rooms toward on-prem or sovereign-cloud designs.
ANSSI (France). The French national cybersecurity agency sets requirements for the operators of vital importance (OIV) and essential services (OSE). French critical-infrastructure control rooms evaluate video wall systems against ANSSI guidance, which favours on-prem, auditable, minimal-attack-surface designs.

United States — FedRAMP, DoD impact levels, and CISA

A US federal facility handling controlled unclassified information cannot route a video wall through a commercial SaaS control plane unless that service holds FedRAMP authorisation at the appropriate level (FedRAMP covers unclassified data only) — and for defence facilities, the DoD impact levels (IL4, IL5, IL6) raise the bar further. The default expectation for these deployments is on-prem processing on the facility's own network, air-gapped where classification requires it. FedRAMP authorisation is something the cloud provider has to earn, typically with an agency sponsor, so cloud-dependent architectures without it are excluded early.

For critical-infrastructure buyers, a CISA video wall requirement is usually not a request for a video wall product certified by CISA. It means the wall must fit the cybersecurity posture expected around CISA-aligned operations: known assets, segmented networks, MFA or SSO for operators, no shared admin passwords, role-based wall control, auditable actions, documented patch windows, controlled remote support, and a recovery path that still works when the site is isolated.

Identity: wall users map to named operators or service accounts, not shared room credentials. Use the video wall RBAC, SSO, and API guide for the operator-access model.
Logging: layout changes, source promotion, admin actions, API calls, and support access are timestamped and retained for incident review.
Isolation: restricted rooms can keep rendering approved local sources without vendor cloud access. See the air-gap video wall guide for no-cloud architecture language.
Supply chain: the buyer can document OS, server, capture, update, support, and software provenance rather than treating the wall as a black box.

ISO 11064 — control-room ergonomics everywhere

ISO 11064 is not a security regulation — it is the international standard for ergonomic design of control centres, and it applies across jurisdictions. It covers the physical layout of the control room, sightlines to the video wall, viewing distances, display heights, and operator workstation arrangement.

ISO 11064 rarely excludes a vendor, but it shapes the wall specification: the viewing distance the standard derives from the room layout drives the display pixel pitch (see the MicroLED article for the pitch-vs-distance calculation), and the sightline requirements drive the wall size and mounting. A procurement that cites ISO 11064 is signalling that the wall design must be justified against operator ergonomics, not just picked from a catalogue.

How compliance shapes the architecture

Strip the jurisdictions down and the regulatory frames converge on a small set of architectural requirements:

On-prem processing. Almost every serious frame requires the video and operational data to stay on-prem. Cloud-dependent architectures are excluded from regulated deployments.
Air-gap capability. The higher-significance categories (FZ-187 critical infrastructure, classified DoD systems at IL6, ANSSI OIV) often require the wall to operate with no outbound connectivity at all.
Auditability. Who changed the wall, when, and what was displayed — the audit trail is a recurring requirement, because post-incident review depends on it.
Minimal attack surface. Fewer external dependencies, fewer open ports, standard auditable components — the security-review posture favours simple over clever.
Domestic-vendor sourcing where mandated. The Минцифры registry requirement is binary — it decides the vendor pool before any technical evaluation.

Where Craft Wall fits — honestly

Craft Wall's architecture aligns with the common requirements: on-premises only, air-gap-capable, browser control served locally, standard auditable Linux components, no cloud dependency. For deployments where the constraint is "keep everything in the building and make it auditable", the architecture is a clean fit.

The honest limits: Craft Wall is not yet listed in the Минцифры registry (the registry application is in progress), so Russian state procurements bound to the registry should evaluate Polywall or another registry-listed vendor today. FedRAMP and BSI C5 apply to cloud services, so an on-prem product such as Craft Wall is outside their scope, and ISO 11064 is a design standard applied to the control room rather than a product certificate. Deployments that require a specific certification as a tender line should confirm the vendor's certification status directly rather than assume architectural alignment equals certification. The architecture being compliant-shaped and the vendor holding a specific certificate are two different things, and a careful procurement checks both.

Closing

Compliance is the first filter in a control-room video wall procurement, not the last. Map the regulatory frames that apply to the deployment, write them into the tender as hard requirements, and evaluate vendors against them before looking at features or price. The architecture requirements converge — on-prem, air-gap-capable, auditable, minimal attack surface — and a vendor that cannot meet those is not a candidate, whatever the demo looks like.

Read next: hybrid cloud video walls for the on-prem / cloud split, video wall RBAC, SSO, and API for CISA-aligned operator access, the NOC reference architecture for a compliant on-prem design, and the eight-platform comparison for where each vendor sits on the compliance axis.

Frequently asked questions

Which regulations apply to control room video wall procurement?

Five regulatory frames decide most procurements: (1) GDPR (EU) for personal-data handling in any camera feed; (2) BSI C5 (Germany) for cloud services in public-sector procurement; (3) ANSSI (France) for operators of vital importance (OIV) and essential services (OSE); (4) FedRAMP + DoD impact levels (US) for federal deployments; (5) ISO 11064 (global) for operator-workstation ergonomics. In Russia, FZ-187 (КИИ) and Минцифры registry compliance are the dominant constraints; in healthcare, HIPAA in the US and similar national laws elsewhere.

Is GDPR a video wall constraint?

Yes whenever camera feeds capture identifiable individuals. GDPR Article 6 requires a legal basis for processing such data; Article 32 mandates security controls; Article 30 requires processing records. Practically: (1) sending feeds outside the EU/EEA requires a transfer mechanism under Chapter V, such as an adequacy decision or standard contractual clauses, (2) operator access must be logged and revocable, (3) recordings may be kept only as long as their purpose requires (Article 5(1)(e)) — GDPR sets no fixed number of days, and EDPB guidance on video devices expects deletion within a few days unless a longer period is justified. On-prem processing with no third-country data path is the simplest way to satisfy these.

What does ISO 11064 require for a control room video wall?

ISO 11064 is the international standard for the ergonomic design of control centres — a design standard, not a product certification. For the video wall it covers the room layout, sightlines from every operator position to the wall, viewing distances, display heights and the arrangement of operator workstations. In practice the viewing distance drives the display pixel pitch and the sightlines drive the wall size and mounting, so a tender that cites ISO 11064 expects the wall design to be justified against operator ergonomics.

How does Минцифры registry affect video wall procurement in Russia?

For state-sector and critical-infrastructure (КИИ) procurements, the customer is required to source from the Минцифры (Ministry of Digital Development) registry of Russian software. Non-registered vendors (Userful, Hiperwall, Datapath, Barco, Christie, VuWall, Craft Wall) are not eligible. Registered alternatives: Polywall (Polymedia) and a small set of domestic players. Foreign-vendor preferences in non-critical AV deployments persist but are tightening under FZ-187 evolution.

Does FedRAMP apply to government control room walls?

FedRAMP applies to cloud-service usage by US federal agencies — directly relevant to cloud-managed and hybrid-cloud video wall platforms serving federal customers. The cloud provider obtains the authorisation at a Low, Moderate or High baseline, Moderate being the most common; defence facilities add the DoD impact levels (IL4 and IL5 for controlled unclassified information, IL6 for classified information up to SECRET), and FedRAMP itself covers unclassified data only. Pure on-prem video wall software is out of FedRAMP scope by definition. Vendors targeting US federal procurement either obtain FedRAMP authorisation for their cloud control plane or position as on-prem-only.