How do you implement SOC 2 CC6.4?

Cloud-only: physical security is the responsibility of your cloud provider (AWS, Azure, GCP), obtain their SOC 2 Type II report annually Document which physical locations you control (home office, colo, leased data center) and apply controls proportional to what's there If using a colocation facility, obtain the colo's physical security attestation (SOC 2 or equivalent) and review it annually (4 steps total)

What evidence is needed for SOC 2 CC6.4?

Current cloud provider SOC 2 Type II report (obtained from AWS Artifact, Azure, or GCP compliance portal), must be for the current audit period, Vendor assessment record in your GRC platform showing cloud provider SOC 2 was reviewed, If using colocation: colo facility SOC 2 or equivalent physical security certification.

What tools help with SOC 2 CC6.4 compliance?

AWS SOC 2 report (via AWS Artifact), Azure SOC 2 report, GCP compliance reports.

How do you implement SOC 2 CC6.4?

Implement badge or key card access for the server room, physical key access with a sign-in log is acceptable for smaller environments Log all entries: who entered, date, time, purpose, keep the log for the audit observation period Restrict server room access to staff who operationally need it; do not grant blanket access to all IT staff (4 steps total)

What evidence is needed for SOC 2 CC6.4?

Physical access log for the server room covering the audit period (or a representative sample), Access control list showing who has physical access and their role justification, Offboarding ticket samples confirming physical access was revoked alongside logical access.

What tools help with SOC 2 CC6.4 compliance?

Key card / badge access system, Physical access log (sign-in sheet or electronic log), CCTV (if applicable), Physical Security Policy.

Browse

33 controls

CC1.1

Commitment to integrity and ethical values

Control Environment

6 evidence2 controls

CC1.2

Board independence and oversight of internal control

Control Environment

3 evidence1 control

CC1.3

Organizational structure, reporting lines, and authority

Control Environment

3 evidence1 control

CC1.4

Commitment to attract, develop, and retain competent individuals

Control Environment

6 evidence2 controls

CC1.5

Accountability for internal control responsibilities

Control Environment

3 evidence1 control

CC2.1

Obtains or generates and uses relevant quality information

Communication and Information

3 evidence1 control

CC2.2

Internal communication of information to support internal control

Communication and Information

6 evidence2 controls

CC2.3

External communication regarding matters affecting internal control

Communication and Information

4 evidence1 control

CC3.1

Specifies objectives with sufficient clarity

Risk Assessment

3 evidence1 control

CC3.2

Identifies and analyzes risks to achievement of objectives

Risk Assessment

3 evidence1 control

CC3.3

Considers potential for fraud in assessing risks

Risk Assessment

3 evidence1 control

CC3.4

Identifies and assesses significant changes

Risk Assessment

3 evidence1 control

CC4.1

Selects, develops, and performs ongoing and separate evaluations

Monitoring Activities

6 evidence2 controls

CC4.2

Evaluates and communicates internal control deficiencies

Monitoring Activities

3 evidence1 control

CC5.1

Selects and develops control activities that mitigate risks

Control Activities

3 evidence1 control

CC5.2

Selects and develops general controls over technology

Control Activities

6 evidence2 controls

CC5.3

Deploys control activities through policies and procedures

Control Activities

3 evidence1 control

CC6.1

Logical access security infrastructure

Logical and Physical Access Controls

11 evidence3 controls

CC6.2

Registration and authorization prior to issuing credentials

Logical and Physical Access Controls

6 evidence2 controls

CC6.3

Role-based access management

Logical and Physical Access Controls

6 evidence2 controls

CC6.4Physical access restrictionsSOC 2Logical and Physical Access Controls

Official Requirement

The entity restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives.

Source: AICPA Trust Services Criteria (2017), incorporating COSO principles

In Plain English

If you run on-prem infrastructure, you need to show that the physical location is locked down. Who has a key or badge? Is there a log of entries? What happens when someone's employment ends, is their physical access revoked along with their logical access? For cloud-only companies, you delegate this to your cloud provider and demonstrate that via their SOC 2 or ISO 27001 report.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon

View in Map →

CC6.5

Disposal and destruction of information assets

Logical and Physical Access Controls

3 evidence1 control

CC6.6

Controls against threats from outside system boundaries

Logical and Physical Access Controls

8 evidence2 controls

CC6.7

Restricts transmission and movement of information

Logical and Physical Access Controls

7 evidence2 controls

CC6.8

Controls to prevent or detect unauthorized software

Logical and Physical Access Controls

6 evidence2 controls

CC7.1

Detection and monitoring for vulnerabilities

System Operations

8 evidence2 controls

CC7.2

Monitoring for anomalies and security events

System Operations

4 evidence1 control

CC7.3

Evaluation of security events as security incidents

System Operations

4 evidence1 control

CC7.4

Incident response program

System Operations

4 evidence1 control

CC7.5

Recovery from security incidents

System Operations

4 evidence1 control

CC8.1

Authorized change management process

Change Management

8 evidence2 controls

CC9.1

Risk mitigation for business disruptions

Risk Mitigation

4 evidence1 control

CC9.2

Vendor and business partner risk management

Risk Mitigation

4 evidence1 control

Browse

Help us build what matters.

What should we add next?

Stay Updated

On-premises implementation and evidence

Physical access controls and entry logging for data center / server room

Implementation steps

Tools / systems

Evidence artifacts