SOC 2 · CC - Common Criteria (Security)
SOC 2 CC6.4: CC6.4 Restricting physical access to facilities and assets
SOC 2 CC6.4 covers CC6.4 Restricting physical access to facilities and assets. The held text names 5 evidence records for it, the first being Badge access provisioning and removal records. The common gap an assessor flags is Physical access not removed at termination.
Physical access to facilities and protected assets such as data centres, rooms holding backup media and other sensitive spaces is limited to authorised personnel. Points of focus: physical access for staff, contractors, vendors and partner personnel to data centres, offices and work areas is created or changed on appropriate authorisation; it is removed when no longer needed; organisation devices such as badges, laptops and phones are recovered when the holder no longer needs access (added in 2022); and access is reviewed periodically against job responsibilities. Where facilities are run by a hosting or cloud provider, the provider's SOC report and the complementary controls it expects are part of the evidence.
What evidence supports CC6.4?
- Physical securityBadge access provisioning and removal records
- Physical securityPeriodic physical access review for sensitive areas
- Physical securityVisitor logs and escort procedure
- Physical securityData centre or cloud provider SOC report reviewed for this criterion
- Physical securityLeaver checklist showing return of badges, laptops and mobile devices
Where this requirement comes from
This is our own statement of SOC 2 CC6.4, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Physical access not removed at termination
- No review of who can enter the server room
- Reliance on a hosting provider with no review of its SOC report
- Badges and laptops not recovered from departing contractors
How it maps to ISO 27001:2022
- 5.15 medium Physical access restriction covers the physical entry half of the access control rules.
- 7.1 high Restricting physical access to facilities and sensitive locations is perimeter definition and enforcement.
- 7.2 high Restriction of physical access to authorized personnel is entry control at the door.
- 7.3 high Securing data centre and other sensitive locations against unauthorized personnel is the same control.
- 7.6 medium Physical restriction to authorized personnel supports secure area rules without prescribing working procedures.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.