Video wall compliance: the regulatory map for control-room procurement

For a control room, NOC, or SOC, compliance is not a box ticked at the end of procurement. It is the constraint that decides which vendors can even bid. A video wall that fails the regulatory review is not a video wall the buyer can install, regardless of price or features. This article maps the regulatory frames that actually shape control-room video wall procurement — by jurisdiction — and how each one constrains the architecture.

Why compliance leads the procurement

A boardroom display has almost no compliance surface. A control-room video wall has a large one, because it carries operational data that regulators classify and protect: live camera feeds (personal data), critical-infrastructure telemetry, security events, network state that reveals customer impact. The wall is not a passive screen — it is an information-processing system, and the regulator treats it as one.

The practical consequence: write the compliance requirements into the tender first, then evaluate vendors against them. A bake-off that ranks vendors on features and discovers the compliance gap afterward wastes everyone's time.

Russia — Минцифры registry and FZ-187

Two frames dominate Russian control-room procurement:

• Минцифры registry of Russian software. State operators and many state-adjacent buyers are required to procure from the registry of domestic software. A non-Russian vendor is excluded from these tenders by definition — this is why Polywall and other registry-listed RU vendors win state procurements that Western stacks cannot enter.
• FZ-187 — critical information infrastructure. Energy, transport, finance, healthcare, and government operations are designated critical infrastructure. Their systems must keep the operational layer in-country, and for the higher significance categories, often air-gapped. A cloud-dependent video wall fails FZ-187 for these buyers — see the hybrid cloud architecture article for the on-prem requirement.

FZ-152 (personal-data localisation) also applies wherever camera feeds capture identifiable individuals — the data must be processed on servers inside Russia.

European Union — GDPR, BSI C5, ANSSI

• GDPR. Live camera feeds containing identifiable people are personal data under Article 4(1). The wall processes that data; processing it through a control plane outside the EU, or one operated by a provider subject to the US CLOUD Act, requires safeguards most facilities cannot establish. The clean answer is on-prem processing with no third- country data path.
• BSI C5 (Germany). The German federal Cloud Computing Compliance Criteria Catalogue sets the cloud-security bar for public-sector procurement. General-purpose SaaS control planes rarely meet it, which pushes German government control rooms toward on-prem or sovereign-cloud designs.
• ANSSI (France). The French national cybersecurity agency sets requirements for the operators of vital importance (OIV) and essential services (OSE). French critical-infrastructure control rooms evaluate video wall systems against ANSSI guidance, which favours on-prem, auditable, minimal-attack- surface designs.

United States — FedRAMP and DoD impact levels

A US federal facility handling controlled unclassified information or classified data cannot route a video wall through a commercial SaaS control plane without FedRAMP authorisation at the appropriate level — and for defence facilities, the DoD impact levels (IL4, IL5, IL6) raise the bar further. The default expectation for these deployments is on-prem processing with NIPRNet or air-gapped isolation. The procurement team rarely obtains a cloud authorisation, so cloud-dependent architectures are excluded early.

ISO 11064 — control-room ergonomics everywhere

ISO 11064 is not a security regulation — it is the international standard for ergonomic design of control centres, and it applies across jurisdictions. It covers the physical layout of the control room, sightlines to the video wall, viewing distances, display heights, and operator workstation arrangement.

ISO 11064 rarely excludes a vendor, but it shapes the wall specification: the viewing distance the standard derives from the room layout drives the display pixel pitch (see the MicroLED article for the pitch-vs-distance calculation), and the sightline requirements drive the wall size and mounting. A procurement that cites ISO 11064 is signalling that the wall design must be justified against operator ergonomics, not just picked from a catalogue.

How compliance shapes the architecture

Strip the jurisdictions down and the regulatory frames converge on a small set of architectural requirements:

• On-prem processing. Almost every serious frame requires the video and operational data to stay on-prem. Cloud-dependent architectures are excluded from regulated deployments.
• Air-gap capability. The higher-significance categories (FZ-187 critical infrastructure, DoD IL5+, ANSSI OIV) often require the wall to operate with no outbound connectivity at all.
• Auditability. Who changed the wall, when, and what was displayed — the audit trail is a recurring requirement, because post-incident review depends on it.
• Minimal attack surface. Fewer external dependencies, fewer open ports, standard auditable components — the security-review posture favours simple over clever.
• Domestic-vendor sourcing where mandated. The Минцифры registry requirement is binary — it decides the vendor pool before any technical evaluation.

Where Craft Wall fits — honestly

Craft Wall's architecture aligns with the common requirements: on-prem-first, air-gap-capable, browser control served locally, standard auditable Linux components, no mandatory cloud dependency. For deployments where the constraint is "keep everything in the building and make it auditable", the architecture is a clean fit.

The honest limits: Craft Wall is not listed in the Минцифры registry — the marketing entity is Swiss — so Russian state procurements bound to the registry should evaluate Polywall or another registry-listed vendor. Craft Wall does not currently hold FedRAMP, BSI C5, or formal ISO 11064 certification; deployments that require a specific certification as a tender line should confirm the vendor's certification status directly rather than assume architectural alignment equals certification. The architecture being compliant-shaped and the vendor holding a specific certificate are two different things, and a careful procurement checks both.

Closing

Compliance is the first filter in a control-room video wall procurement, not the last. Map the regulatory frames that apply to the deployment, write them into the tender as hard requirements, and evaluate vendors against them before looking at features or price. The architecture requirements converge — on-prem, air-gap-capable, auditable, minimal attack surface — and a vendor that cannot meet those is not a candidate, whatever the demo looks like.

Read next: hybrid cloud video walls for the on-prem / cloud split, the NOC reference architecture for a compliant on-prem design, and the eight-platform comparison for where each vendor sits on the compliance axis.

Related reading

• Hybrid cloud video walls: the metadata-in-cloud, pixels-on-prem pattern
• Video wall for NOC: a reference architecture for 24/7 telco operations
• Best video wall software in 2026: eight platforms compared honestly
• MicroLED for control room video walls: where it fits in 2026 and where it does not
• Craft Wall vs Polywall (Polymedia) · comparison
• SCADA (Supervisory Control and Data Acquisition) · glossary
• SOC (Security Operations Center) · glossary