ISO/IEC 27001 and SOC 2 for Facilities Teams

ISO/IEC 27001 and SOC 2 for Facilities Teams

Data centers operate at the intersection of physical infrastructure and information security. Two frameworks—ISO/IEC 27001 and SOC 2—define controls that your facility must satisfy. Understanding which controls belong to the facilities team, and which belong to IT security, is essential for audit readiness and for earning and maintaining customer trust.

What ISO/IEC 27001 Requires of Facilities

ISO/IEC 27001 is an international standard for information security management systems (ISMS). The 2022 revision organizes its controls in Annex A into four themes: Organizational, People, Physical, and Technological. The Physical theme contains the controls that directly involve the data center facilities function.

Key physical controls from Annex A that a facilities manager typically owns include:

• Physical security perimeters — defined boundaries such as fences, walls, card-access doors, and mantrap vestibules that restrict entry to secure areas.
• Physical entry controls — badge readers, biometric readers, visitor logs, and escort procedures that ensure only authorized individuals enter restricted zones.
• Securing offices, rooms, and facilities — locks, access control systems, and placement of sensitive equipment away from public areas.
• Physical security monitoring — CCTV systems, motion detectors, and intrusion alarms. The facilities team installs and maintains the hardware; IT security may monitor feeds, but the facilities manager usually holds the maintenance records and equipment inventory.
• Protection against physical and environmental threats — controls addressing fire, flood, earthquake, temperature extremes, and power failure. This includes fire suppression systems, water leak detection, UPS and generator maintenance records, and HVAC management.
• Working in secure areas — procedures that govern how contractors and vendors behave inside restricted spaces, including escorting requirements and tool control.
• Clear desk and clear screen — while partly a personnel control, facilities teams support it by providing locked cabinets and shredders.
• Supporting utilities — documented inspection and testing of power feeds, UPS, generators, and cooling systems. Facilities owns the service records.
• Cabling security — physical protection and labeling of power and data cabling to prevent unauthorized access or damage.
• Equipment maintenance — scheduled preventive maintenance logs for all mechanical and electrical systems.
• Secure disposal or reuse of equipment — procedures and records for media sanitization and hardware disposal, often shared with IT but physically executed on the data center floor.

The critical audit insight is this: evidence ownership follows who physically controls the system or produces the record. A firewall policy is an IT security deliverable; a generator test log is a facilities deliverable. Both can appear on an ISO 27001 audit checklist.

SOC 2 and the Trust Services Criteria

SOC 2 is a reporting framework developed by the AICPA (American Institute of Certified Public Accountants). A SOC 2 Type II report covers a period of time—commonly six to twelve months—and provides an auditor's opinion on whether a service organization's controls operated effectively throughout that period.

SOC 2 is organized around five Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. Data centers most commonly address Security, Availability, and Confidentiality.

Physical and environmental controls appear prominently in the Common Criteria (CC) section under Security, specifically the CC6 logical and physical access category and related sub-criteria. Controls relevant to facilities include:

• Physical access controls — restricting and logging entry to the data center environment. Facilities produces door-access logs, visitor logs, and CCTV retention records.
• Environmental monitoring — continuous temperature, humidity, and water-leak sensor data. BMS (Building Management System) or DCIM (Data Center Infrastructure Management) reports are the evidence.
• Power and cooling availability — UPS test records, generator run logs, maintenance work orders, and redundancy configuration documentation. All of these are facilities deliverables supporting the Availability criteria.
• Media handling and disposal — physical destruction or sanitization records for storage media leaving the facility support Confidentiality criteria.

A bridge letter (also called a coverage letter) is a document a service organization issues to extend audit assurance when the SOC 2 report does not cover the full period a customer needs. Facilities teams may be asked to confirm that no significant changes to physical controls occurred during the gap period.

Shared Controls and Evidence Negotiation

Many controls are shared between facilities and IT security teams. Physical access logs, for example, may be generated by a badge system managed by facilities but reviewed for anomalies by IT security. For audit purposes, it is critical to agree in advance:

1. Who owns the control — the team accountable for its design and operation.

2. Who produces the evidence — the team that generates the record.

3. Who presents the evidence — the team that delivers it to the auditor.

Document this in a RACI matrix (Responsible, Accountable, Consulted, Informed) before any audit begins. Ambiguity discovered during an audit, rather than before it, is a common cause of findings and delays.

Safety Considerations

Audit walkthroughs bring auditors and consultants onto the data center floor. Always apply standard access control and escort procedures during these visits. Ensure visitors wear appropriate PPE—safety glasses and closed-toe shoes at minimum—when passing through mechanical or electrical spaces. Never bypass lockout/tagout procedures to demonstrate a system to an auditor; schedule demonstrations around maintenance windows with proper energy isolation in place.

Practical Takeaway

As a facilities professional, you are a first-line contributor to two major compliance frameworks. Your maintenance logs, access records, environmental sensor reports, and equipment inspection documents are not administrative tasks—they are audit evidence. Treat them accordingly: keep them complete, accurate, dated, and retrievable.