Developing a Physical Access Policy for the SOC 2 Type II Audit

Every security audit eventually asks the same blunt question. Who can get in, and how do you prove it? Most companies answer that question for their networks and forget to answer it for their front door. A cybersecurity protocol that only covers firewalls and passwords is missing a wall, and auditors know it.

Physical Least Privilege

In January 2019, Net Friends moved into a new headquarters in Durham and designed the badge and access system from scratch. Protecting our staff is always the priority, and a move meant starting that job with a blank floor plan and no existing infrastructure to lean on.

That reality collided with our SOC 2 Type II requirements the moment we moved past the exterior doors. The audit required access to every office, room, and facility to follow the principle of least privilege, which meant the inside of the building needed the same scrutiny as the parking lot. A locked front door means very little if every interior room shares one key.

The team's answer was to remove physical keys from the building entirely. Every exterior and interior door runs on a digital badge system, split across six physical security zones with their own access rules. A staff badge that opens the main entrance and a shared workspace does not necessarily open a server room or a records archive, and that gap is intentional. Cameras cover each zone and every exterior entrance, giving the team a record of who moved where and when, not just whether a door opened.

None of that work stayed informal. The team kept a full documentation trail for our SOC 2 Physical Access Policy, ran a matching policy with our partners at Castra Consulting to onboard and offboard their staff's badge access as projects started and ended, and tracked badges for every visitor and housekeeping shift on top of it. Offboarding a badge takes seconds. Forgetting to offboard one is how physical security policies quietly fail, and the documentation trail exists precisely to catch that before it happens.

Security camera footage — Net Friends HQ

Front entrance · 2026-06-09 · 02:14:21

Overhead cam · After hours

Interior entrance · After hours

Our nightly visitors — unbadged, unscheduled, and entirely unbothered.

× ‹ ›

Fun Side Note

The cameras were built to watch for people. It turns out they were just as reliable at catching foxes. Ours trot past the building after hours on a schedule regular enough that the team has started to recognize them, unbothered by the lenses, in no hurry, clearly convinced the property was theirs after dark. No fox has ever badged in, and none has ever needed to. That is one access request we are glad to leave denied.

Why does physical security matter?

Watching the wildlife aside, physical security often gets overshadowed by firewalls and encryption, but it plays a starring role in a SOC 2 Type II audit. While logical controls protect your data from digital intruders, physical security protects the actual hardware, servers, and workspaces where that data lives and breathes. Auditors want to see that access to data centers, offices, and sensitive equipment is tightly controlled through things like badge systems, visitor logs, security cameras, and locked server rooms. Without these safeguards in place, even the most sophisticated cybersecurity stack can be undermined by something as simple as an unlocked door.

What makes physical security especially important in a Type II audit is the operating effectiveness piece. It is not enough to have a badge reader installed on day one. Auditors are checking whether your controls worked, consistently, over the entire review period, usually six to twelve months. That means your access logs, incident records, and offboarding procedures need to show a real pattern of diligence, not just a policy sitting in a binder somewhere. Think of it less like a one-time security sweep and more like a long-term relationship with your building's locks.

It is easy to treat physical access as a footnote next to encryption and endpoint protection, but the two are more connected than they look. An unattended badge, a propped door, or a visitor wandering unescorted can undo a great deal of careful network security in about the time it takes to plug in a USB drive. Least privilege only works as a concept if it applies to the whole building, not just the parts of it that run on a server.

The Auditor and Foxes Agree

The auditor who reviewed our badge system, camera coverage, and access procedures on site agrees everything was in order, no exceptions, and no gaps. We would not have it any other way. Physical security rarely gets the same spotlight as encryption or firewalls, but at Net Friends it carries the same weight, because a protocol with an unlocked door is not a protocol at all.