Many cloud-first teams assume physical security is someone else's problem. Your servers live in a data center you'll never visit, so why worry about locks and badges? Then an auditor asks how you control access to your office, what happens to old laptops, and whether you can prove your provider's data centers are secure. The problem you thought you'd outsourced is suddenly yours again.

Physical and environmental security is one of the oldest control domains in every major framework, and it didn't disappear when you moved to the cloud. It just split in two. There are the controls you still own, like your office and your devices, and the controls you inherit from your cloud provider, which you verify rather than run. This post covers both, and how OptiTech tracks them as part of one program.

Why physical security still shows up in your audit

Every serious framework treats physical and environmental security as a first-class domain. ISO 27001 dedicates a whole set of controls to it. SOC 2 folds it into the common criteria. NIS2 and DORA both expect you to protect the physical spaces and equipment that support essential services. None of them give you a pass because you run on someone else's infrastructure.

The reason is simple. A laptop left on a train, a stranger who tailgates into your office, or a box of old drives sent to recycling without wiping can leak the same data an attacker would love to steal over the network. Physical controls close the gaps that firewalls can't see. Auditors know this, so they ask, and buyers running a security review ask too.

The controls you still own

Moving to the cloud shrinks your physical footprint, but it doesn't erase it. You still have people, offices, and devices, and each one needs a control you can point to.

Office access controls

If you have any office space, you need to control who gets in. That usually means badge or key access, a record of who holds credentials, and a process to revoke access the day someone leaves. The control isn't the lock on the door. It's the discipline of granting access deliberately, reviewing it on a schedule, and removing it fast when a role changes.

For fully remote teams, this shrinks to almost nothing, and that's a valid answer. The point is to state your position and prove it, not to invent an office you don't have.

Visitor management

When someone from outside walks into a space where work happens, you should know who they are, why they're there, and who's responsible for them. A simple visitor log, a sign-in process, and a rule that guests are escorted covers most of it. This matters more than teams expect, because a visitor with a clear view of a whiteboard or an unlocked screen can walk out with information you'd never hand over on purpose.

Clear desk and clear screen

A clear desk policy asks people to lock away sensitive documents and devices when they step away. A clear screen policy asks them to lock their screen so nothing sensitive sits in plain view. Both sound old-fashioned in a paperless office, but they're cheap, they're easy to check, and they close a real gap. In a shared or hybrid workspace, an unlocked screen is an open door.

Secure disposal

Every device and document reaches the end of its life eventually, and that's a moment of real risk. Old laptops, phones, and drives have to be wiped or destroyed before they leave your control, and paper records need shredding rather than a trip to the recycling bin. You should keep a record of what was disposed of, when, and how, so you can prove data didn't walk out the door on retired hardware.

The controls you inherit from your cloud provider

Here's where cloud-first actually helps. The physical security of the data centers that run your workloads is your provider's job, and the big providers are very good at it. Biometric access, round-the-clock guards, backup power, fire suppression, and environmental monitoring are all handled for you.

You don't run those controls, but you're still accountable for them. That means you can't just assume they exist. You have to verify them and keep the proof. The proof is your provider's certifications and audit reports: their ISO 27001 certificate, their SOC 2 report, and the physical security sections inside them. When an auditor asks how the data centers holding your data are protected, you point to that evidence instead of the controls themselves. This is called inheriting a control, and it's completely legitimate as long as you can show the paperwork.

Data residency is part of this picture too. If you've committed to keeping data in the EU, you need to know which regions your provider actually uses. OptiTech customers running in Stockholm and Frankfurt can name the exact locations and back the claim with the provider's regional certifications.

Track physical controls and provider evidence together

The hard part isn't understanding these controls. It's keeping them connected and current, so you're never scrambling when someone asks. That's the job OptiTech does.

In the OptiTech Console, physical and environmental security is a set of controls inside your program, mapped to every framework that needs them. Your owned controls, like clear desk and secure disposal, carry their own evidence: the policy, the disposal log, the access review. Your inherited controls link straight to your provider's certifications and reports, so the proof lives next to the control it satisfies.

When a control maps to SOC 2, ISO 27001, NIS2, and DORA at once, you maintain it in one place and it satisfies all four. When a provider certificate expires, OptiTech flags it before it becomes a gap in an audit.

From control to trust center

The same physical controls that satisfy your auditor also answer buyer questions. Enterprise security reviews almost always ask about office access, device handling, and data center security. When those controls live in your program with evidence attached, you can publish the answers.

A trust center backed by your OptiTech program lets buyers see your physical security posture and your provider's certifications without emailing your team. The work you did for the audit starts closing deals on its own.

Getting started

You don't need a fortress. You need a clear, provable position on each part of physical security:

1. List the controls you own across office access, visitors, clear desk and screen, and disposal, even if some are minimal for a remote team.
2. Attach evidence to each one, like your policy, your access reviews, and your disposal log.
3. Add your inherited controls and link your provider's current certifications as proof of data center security.
4. Connect it to a trust center so buyers can see your posture without a single email.

Physical security didn't go away when you moved to the cloud. It just changed shape. Track the controls you own, verify the ones you inherit, and keep the evidence in one place, so your next audit and your next security review both get a straight answer.

Ready to bring physical controls into one program? Book a demo and see how OptiTech connects your controls, evidence, and provider certifications.