CC6.4 Restricting physical access to facilities and assets

Physical access to facilities and protected assets such as data centres, rooms holding backup media and other sensitive spaces is limited to authorised personnel. Points of focus: physical access for staff, contractors, vendors and partner personnel to data centres, offices and work areas is created or changed on appropriate authorisation; it is removed when no longer needed; organisation devices such as badges, laptops and phones are recovered when the holder no longer needs access (added in 2022); and access is reviewed periodically against job responsibilities. Where facilities are run by a hosting or cloud provider, the provider's SOC report and the complementary controls it expects are part of the evidence.

Source: SOC 2 (2017 Trust Services Criteria), CC6.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.