← SOC 2 · CC6 — Logical and Physical Access
CC6.4 — Physical access to facilities
medium
physical-security
Requirement
The entity restricts physical access to facilities and protected information assets to authorised personnel.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
physical accessbadgefacilitydata centredata centerpremises
Supporting terms — specificity signals
visitor logescortcctvdoorcolocationsub-processor facility
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| ISO 27001 | A.7.1 | Physical security perimeters | physical-security |
| HIPAA | 164.310(a)(1) | Facility access controls (R) | physical-security |
| ISO 27001 | A.7.4 | Physical security monitoring | physical-security |
| ISO 27001 | A.7.9 | Security of assets off-premises | physical-security |
| PCI DSS 4.0.1 | 9.4 | Media with cardholder data is secured and destroyed | physical-security |
| PCI DSS 4.0.1 | 9.5 | Point-of-interaction devices are protected from tampering | physical-security |
| HIPAA | 164.310(b)-(c) | Workstation use and security (R) | physical-security |