What is physical access control?
Physical access control limits who can enter buildings, data centers, and restricted rooms. Common mechanisms are badge readers, biometrics, locks, and access logs. For cloud-hosted services, data center physical security is the cloud provider's responsibility.
What the buyer is really asking
For data centers, cloud-hosted companies inherit this from their provider, so say so and point to the provider's report. For offices, describe badge access and whether customer data is ever stored there.
Other ways buyers ask it
Every one of these wants the same answer:
- “How do you control physical access to data centers and offices?”
- “Do you log and audit physical access?”
- “Are physical security policies documented?”
Evidence to have ready
- Your cloud provider's SOC 2 report covering physical security
- Office badge access logs, if you have an office
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.