polara labs

SOC 2 · Trust Services Criteria · 2 min read

SOC 2 CC6.4: physical access, explained for startups

What CC6.4 asks you to show about physical access, and what proves it.

Only authorized people can get into the places where your systems live. For a cloud company with no server room this mostly rests on your cloud provider, whose own report covers its data centers. An office with equipment adds badges, visitor logs and a locked room.1

CC6.4 is a common criterion, so it is part of every SOC 2 report.

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC6.4, the usual records are these.

  • Your cloud provider's SOC 2 report covering its data centers
  • Office badge access lists and reviews, where you have an office
  • Visitor logs

What Polara asks about it

The free readiness assessment asks 6 questions that bear on CC6.4. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

  • How is access to these offices or coworking spaces controlled? If no, the fix: install badge or electronic access control on areas that hold in-scope systems and keep an access log.
  • Are visitors required to be escorted and recorded when entering areas with company systems or records? If no, the fix: introduce a visitor log and an escort requirement for areas with company systems or records.
  • Are work areas with access to production systems or sensitive data separated from public or shared spaces? If no, the fix: move production access to a separated work area or restrict production access to managed devices with screen privacy controls.

It also asks, for context:

  • Office location(s) in scope.
  • Do you have physical offices or coworking spaces storing systems, laptops, or records?
  • Confirm your team is fully remote and no physical office stores company systems or records.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

If you also run ISO 27001, the Annex A controls A.7.1, physical perimeters, A.7.2, getting into the building, A.7.3, securing offices and rooms, A.7.4, physical monitoring, A.7.6, working in secure areas, A.7.7, clear desk and screen, A.7.8, placing equipment safely, A.7.9, devices off site and A.7.12, cabling ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Yes, always. CC6.4 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Logical and physical access: the criteria around it

CC6.4 is one of 8 criteria in logical and physical access, CC6.1 to CC6.8. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

Before it: CC6.3, least privilege. After it: CC6.5, data and device disposal. All the criteria are on the Trust Services Criteria page, grouped by category.

Questions

What does SOC 2 CC6.4 ask a startup to show?
Only authorized people can get into the places where your systems live. For a cloud company with no server room this mostly rests on your cloud provider, whose own report covers its data centers. An office with equipment adds badges, visitor logs and a locked room.
What evidence proves CC6.4?
The usual evidence is your cloud provider's SOC 2 report covering its data centers, office badge access lists and reviews, where you have an office and visitor logs. An auditor tests it across the report period, so dated records matter more than a written promise.

Sources

  1. TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Related

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.