SOC 2 and ISO 27001 physical controls testing
Most audit evidence for physical security is a policy, a badge report and a photo of a locked door. It shows the control exists, not that it works. We test whether your physical access controls actually do what the policy says, map every finding to SOC 2 CC6.4, ISO 27001 Annex A.7 or the other frameworks you answer to, and give you time to fix them before the audit.
Who it is for
- Companies preparing for a first SOC 2 Type II or ISO 27001 certification with offices, server rooms or colocation in scope.
- Teams that had a physical access exception in a previous audit and want it closed for good.
- Data center and colocation operators whose customers rely on their physical controls in their own audits.
- Organizations with PCI DSS Requirement 9, HIPAA §164.310 or CMMC PE in scope as well.
What we assess
- Physical access provisioning and approval, compared against what the access control system actually grants.
- Deprovisioning: leavers tested at the reader, not only against the HR list.
- Periodic access reviews: whether they happen, and whether they would catch a problem.
- Visitor and contractor management, and whether the logs would stand up in an investigation.
- Credential technology and clone exposure.
- Secure areas, media handling and disposal of equipment holding data.
What you receive
- Every finding mapped to the control IDs it affects: SOC 2 CC6.4 and CC6.5, ISO 27001 A.7, and others in scope.
- Evidence your team can hand to the auditor once each fix is in.
- Findings ranked, each with a price range and the change to make.
- A re-test of Critical and High findings within 90 days, before the audit window, so the fix is proven.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two days on site per site, with the report two weeks later. Best started three to six months before the audit period. One site starts from $9,500.
Common questions
Are you our auditor?
No. We assess and test, and issue no attestation, opinion or certificate. The point is that nothing surprises you when your auditor looks.
Our controls are in a colocation facility. Is that covered?
Yes. We test what you control directly, review the operator’s assurance reports for the rest, and map both to the controls in scope. See the colocation cage access audit.
Which guides explain the controls?
See SOC 2 CC6.4 and ISO 27001 Annex A.7.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
SOC 2 & ISO 27001 physical controls testing
We reply within one business day.
Nothing you send is shared outside Calibre.