Security Architecture
Physical access to company facilities is restricted; hosting provider physical/environmental controls are relied upon and reviewed; company devices are recovered or securely disabled when no longer required.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Access to company workspaces and devices is limited to authorized people, visitors are controlled, provider-operated facilities are evaluated through available assurance, and devices are recovered or securely disabled at end of use.
First SOC 2 program
For a remote-first team, focus on company-device inventory, secure delivery and return, coworking or office keys, visitor handling, and verified remote lock or wipe. Document which physical safeguards are operated by cloud and office providers instead of claiming to operate their facilities directly.
As the company scales
Centralize badge and visitor records, reconcile access with active personnel, define restricted areas, maintain device chain of custody, test remote disablement, and periodically review hosting and workplace provider assurance and exceptions.
List company-controlled offices and storage areas, remote-worker device scenarios, cloud or colocation providers, restricted assets, and the party responsible for each physical safeguard.
You should end up with: A physical-security scope map distinguishing company-operated controls from provider-operated safeguards.
Issue badges or keys to named active personnel based on need, restrict sensitive areas, record issuance, and promptly disable or recover access when the need ends.
You should end up with: A current physical-access list with issuance, authorization, status, and deactivation records.
Require visitor identification or host confirmation, record arrival and departure, provide visible temporary access where appropriate, and escort visitors in restricted areas.
You should end up with: Dated visitor records and documented host or escort responsibility.
Track device assignment and shipment, require secure storage and prompt loss reporting, and recover, lock, or wipe devices when employment, contract, ownership, or business need ends.
You should end up with: Asset custody records plus confirmed return, remote lock, wipe, or retirement status.
Evaluate available facility and environmental assurance from hosting providers, review company access lists and exceptions, and follow up on stale badges, missing devices, or assurance gaps.
You should end up with: A dated review of provider assurance, workplace access, device recovery, and completed corrective actions.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Current badges, keys, codes, and restricted-area permissions are tied to named active people, approved need, issuance, use where logged, and timely revocation.
Include this context
Person
Include this context
Credential ID or type
Include this context
Authorized location
Include this context
Approval and issue date
Include this context
Status and revocation time
Include this context
Access event where available
Weak evidence to avoid
A list of badge numbers or shared door codes with no named holder, location scope, authorization, active status, revocation time, or review date.
Confirm what the record proves
Non-employees entering controlled workspaces are attributable to a host, time-bounded, and subject to the intended visitor and escort process.
Include this context
Visitor identity
Include this context
Host
Include this context
Purpose
Include this context
Arrival and departure
Include this context
Areas visited
Include this context
Escort or temporary credential
Weak evidence to avoid
An undated visitor sign-in with an unreadable name and no host, departure time, purpose, area, escort, or temporary credential return.
Confirm what the record proves
A device due for return or disablement reached a verified custody, lock, wipe, repair, reuse, or disposal state tied to its former custodian.
Include this context
Asset and serial ID
Include this context
Former custodian
Include this context
Recovery trigger and date
Include this context
Return, lock, or wipe action
Include this context
Completion timestamp
Include this context
Verified final disposition
Weak evidence to avoid
A shipping label or wipe request with no serial number, receipt, remote-action result, custody transfer, or confirmed final disposition.
Confirm what the record proves
Available independent assurance for a hosting or workplace provider was reviewed for applicable facility and environmental safeguards, period coverage, exceptions, and customer responsibilities.
Include this context
Provider and service
Include this context
Report type and period
Include this context
Applicable facility scope
Include this context
Relevant exception
Include this context
Customer responsibility
Include this context
Reviewer and review date
Weak evidence to avoid
A provider trust-page badge or expired certificate with no report period, facility scope, exceptions, customer responsibilities, or internal review decision.
Type 1
As of the selected date, retain current workplace credential assignments, current device custody and management state, the latest visitor record review, and the latest applicable hosting or workplace provider assurance review.
Type 2
Include every workplace badge, key, code, and restricted-area issuance, change, and revocation; every recorded visitor entry; every device recovery, lock, wipe, or disposal action triggered during the review period; and every required provider facility-assurance review, exception, and follow-up.
Reconcile active and departed personnel to current workplace credentials, reception records to visitor logs, lifecycle events to assigned-device recovery or remote-action state, and the in-scope hosting and workplace provider inventory to current assurance reviews and tracked exceptions.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Access to company workspaces and devices is limited to authorized people, visitors are controlled, provider-operated facilities are evaluated through available assurance, and devices are recovered or securely disabled at end of use.
Compare the documented owner with the intended role (Infrastructure / Security Operations / IT), then compare dated records with the stated cadence: Continuous/ongoing; periodic review by risk.
Reconcile active and departed personnel to current workplace credentials, reception records to visitor logs, lifecycle events to assigned-device recovery or remote-action state, and the in-scope hosting and workplace provider inventory to current assurance reviews and tracked exceptions.
As of the selected date, retain current workplace credential assignments, current device custody and management state, the latest visitor record review, and the latest applicable hosting or workplace provider assurance review.
Include every workplace badge, key, code, and restricted-area issuance, change, and revocation; every recorded visitor entry; every device recovery, lock, wipe, or disposal action triggered during the review period; and every required provider facility-assurance review, exception, and follow-up.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Current badges, keys, codes, and restricted-area permissions are tied to named active people, approved need, issuance, use where logged, and timely revocation.
For each selected record, confirm it demonstrates Non-employees entering controlled workspaces are attributable to a host, time-bounded, and subject to the intended visitor and escort process.
For each selected record, confirm it demonstrates A device due for return or disablement reached a verified custody, lock, wipe, repair, reuse, or disposal state tied to its former custodian.
For each selected record, confirm it demonstrates Available independent assurance for a hosting or workplace provider was reviewed for applicable facility and environmental safeguards, period coverage, exceptions, and customer responsibilities.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.