The purpose of data center operations is to provide computing, storage, and networking services from a central facility. Data centers often already have strong controls in place to protect infrastructure and maintain uptime. Independent CPA examinations evaluate controls over physical access, environmental protection, and other services within the examination scope. CC6.4 addresses physical access, while A1.2 addresses environmental protections when management includes Availability in the examination.
Why do we need data centers when businesses use cloud services? Cloud services still rely on physical infrastructure. Data centers house the servers, storage, network equipment, power systems, and cooling resources that support hosted services.
A company that hosts its systems at a third-party data center often relies on the facility's SOC 2 report. However, that report may exclude the company's location or leave important responsibilities outside its examination scope. This creates a gap between the assurance management expects and the evidence the service auditor examines. Understanding why SOC 2 matters for a data center requires a clear view of physical security, environmental controls, and responsibility between the facility and the hosted company.
Concern
Data center operators and the companies hosted in them are unsure which controls a SOC 2 examination covers at the facility, and who is responsible for what. Unclear responsibility for physical access, environmental protection, and supporting evidence can create exceptions or gaps in assurance.
Overview
The blog walks through the physical access and environmental criteria examined at a data center. It explains the carve-out and inclusive methods, how a hosted company treats the facility as a subservice organization and maps its complementary controls, and what evidence the auditor requests.
Solution
Readers learn where the facility's responsibility ends and the hosted company's begins, and what a data center's SOC 2 report does and does not cover.
Where Do Data Centers Fit Within the Trust Services Criteria?
The purpose of data center services determines which commitments, system components, and controls management describes. Data centers fall within the Trust Services Criteria according to the services and commitments that management describes in the system description.
What is the purpose of data center operations?
The purpose of data center services is to provide a controlled environment for computing, storing, and transferring information. A facility houses servers, storage equipment, networking devices, power supplies, and cooling systems. These resources support the applications and services that other companies use.
Why do we need data centers to be SOC 2 compliant if companies operate online? To ensure that the facility's controls support the commitments and requirements that management identifies.
The purpose of data centers give rise to physical and environmental risks. Unauthorized entry may expose equipment to interference. A power interruption or cooling failure may affect service availability. The auditor considers these risks against management's commitments and system description.
How do tiers of data centers differ from SOC 2?
Tiers of data centers describe facility design and redundancy classifications. The Uptime Institute, for example, uses Tier I through Tier IV classifications. These classifications differ from the AICPA Trust Services Criteria.
A SOC 2 examination evaluates controls against management's commitments and applicable criteria. It does not assess or award a facility tier rating. A tier rating therefore does not replace an independent SOC 2 examination. The auditor evaluates controls and evidence, not a design classification.
Which Physical and Environmental Controls Do Auditors Examine?
The CPA evaluates whether the facility's physical and environmental controls support the services described in the system description.
How does CC6.4 address physical access?
CC6.4 addresses restrictions on physical access to facilities and protected information assets. The CPA may examine authorization lists, access reviews, entry logs, visitor records, and access removal records.
The auditor compares active access rights with authorization and review evidence to assess whether access remains appropriate. CC7.2 addresses monitoring system changes and security events. CC6.5 addresses asset and information disposal.
How does A1.2 address environmental protection?
A1.2 addresses environmental protections when management includes Availability. Examples may include fire suppression systems, uninterruptible power supplies (UPS), backup generators, cooling equipment, and environmental monitoring.
The CPA may inspect maintenance records, inspection reports, test results, and monitoring logs. Generator test results help demonstrate its ability to support the facility during a power interruption.
A Type 2 examination tests operation across a period. A Type 1 examination evaluates design and implementation at a date. The purpose of data center environmental controls relates to service availability, while the CPA evaluates the evidence relevant to the examination type and period.
How Do Carve-Out and Inclusive Methods Affect Reliance on a Facility's Report?
A facility may act as a subservice organization when it provides infrastructure services to a hosted company. The report's method affects which facility controls the auditor includes in the examination.
What is the difference between the two methods?
The carve-out method excludes the subservice organization's controls from the CPA's examination. The system description identifies the facility's services and the complementary subservice organization controls (CSOCs) that the hosted company expects the facility to operate.
The inclusive method includes relevant subservice organization controls in the system description and examination. The subservice organization provides a written assertion, and the CPA examines and tests the included controls.
For SOC 2 data centers, this distinction shows which facility controls the report covers and which controls the hosted company evaluates separately.
What should a hosted company check in the facility's report?
A hosted company can review six items:
- Scope: Does the report identify the facility location and services the company uses?
- Period: Does the examination period overlap with the company's relevant period?
- Opinion: Did the CPA issue an unmodified or modified opinion?
- Exceptions: Do reported exceptions affect relevant CSOCs?
- Control mapping: Do CSOCs align with the hosted company's controls under CC9.2?
- Bridge letter: Does the facility provide information about the period between the report date and the current date?
Why SOC 2 matters here relates to reliance. A hosted company evaluates the report in the context of its own system, vendor risk process, and control responsibilities. A report for one facility does not establish coverage at another location.
What Evidence Does the CPA Request, and What Does the Facility's Report Exclude?
The purpose of data center controls informs the evidence that the auditor examines. Responsibility depends on the services, contracts, system description, and actual control ownership. The table illustrates common evidence requests, not a mandatory AICPA checklist.
Which party provides the evidence?
-
Physical access restrictions
Relevant criterion: CC6.4
Examples of evidence the CPA may examine: Access authorization records, access lists, entry logs, visitor records, and periodic access reviews
Typical responsibility: Facility or hosted company, according to physical access arrangements
-
Monitoring of system components and unusual activity
Relevant criterion: CC7.2
Examples of evidence the CPA may examine: Monitoring alerts, investigation records, alarm logs, and relevant physical security records
Typical responsibility: Facility or hosted company, according to system responsibilities
-
Environmental protection and recovery infrastructure
Relevant criterion: A1.2
Examples of evidence the CPA may examine: Fire suppression inspections, UPS and generator tests, cooling maintenance, environmental monitoring, and backup records
Typical responsibility: Facility and hosted company, according to control ownership
-
Protection of assets during disposal
Relevant criterion: CC6.5
Examples of evidence the CPA may examine: Asset disposal records, data sanitization evidence, destruction certificates, and chain-of-custody records
Typical responsibility: Facility or hosted company, according to asset ownership and disposal responsibilities
-
Vendor and subservice organization risk management
Relevant criterion: CC9.2
Examples of evidence the CPA may examine: Vendor assessments, SOC 2 report reviews, exception evaluations, CSOC mapping, and relevant follow-up records
Typical responsibility: Hosted company
For SOC data center arrangements, the CPA evaluates whether each party provides evidence for the controls within its responsibility. The CPA examines records that demonstrate each party's control operation.
What does a facility's report not cover?
A facility's report does not automatically cover every system or activity that uses its infrastructure. The hosted company generally retains responsibility for application access, customer permissions, and backups. These may appear as complementary user entity controls (CUECs).
The report covers only its specified system, locations, controls, and examination period. A tier rating falls outside the SOC 2 opinion. The service auditor issues an attestation report with an opinion on controls within scope, not a certification.
Conclusion
The purpose of data center services helps explain why physical access, environmental protection, and clear control ownership matter to hosted companies. Management evaluates the report's locations, period, opinion, exceptions, and CSOCs before relying on it.
CertPro is an independent licensed CPA firm that conducts SOC 2 examinations. Its auditors use inquiry, inspection, observation, and testing, among other methods, to evaluate controls and supporting evidence against the applicable Trust Services Criteria.
