How to answer
What physical security controls protect your data centres?
You do not run a data centre. Saying so, and naming who does, is the complete answer.
We operate no data centres. All production infrastructure runs on [your cloud provider] in the [regions] you operate in, and physical security is inherited from them: their SOC 2 Type II report and ISO 27001 certification cover it. Our own offices hold no customer data.
Square brackets are yours to fill in. FillTrust grades an answer like this confirmed in your documents when your documents support it.
- Answered from
- Your cloud provider's compliance documentation, and your own office policy if you have an office.
- Evidence to attach
- Your provider's SOC 2 or ISO certificate, which is public. Yours is not required for infrastructure you do not operate.
- Where it is asked
- CAIQ v4.0 · DCS-07SIG LiteISO 27001 Annex A · A.7.1
This is the clearest example on any questionnaire of a shared responsibility question, and the most common mistake is answering it as if you were the cloud provider.
Name the provider and the regions. That is most of the answer. Physical access control, environmental protection, power redundancy and media destruction at the facility level are the provider's controls, and they are audited annually in reports you can point at rather than reproduce. A reviewer reading "we operate no data centres; production runs on AWS in eu-west-1, and physical controls are covered by their SOC 2 Type II" has everything they need for this row and the six that follow it about fire suppression, power and environmental monitoring.
Do not describe controls you have never seen. Copied paragraphs about biometric access and 24/7 guards are recognisable, and they undermine the answers around them. If the questionnaire insists on detail, link the provider's compliance page. That is the appropriate source, and pointing at it is a better answer than paraphrasing it.
Your office is the part that is genuinely yours. Most small companies have either no office or a room in a shared building, and no customer data is stored there. Say that. If backups, hardware or printed material do live somewhere, then who can get into that room is a real question and deserves a real sentence: locked, access limited to employees, no customer data held on paper.
Fully remote is an answer, not a gap. "We are a distributed company with no office; all company data is held in cloud services and all devices are managed and encrypted" answers this question, the office access question, and the clear-desk question together, and it is increasingly the most common truthful answer.
Expect this to grade as confirmed once your documentation names your hosting provider anywhere. If it does not, that is one sentence in an infrastructure or security overview, and it unlocks an entire domain of the questionnaire.
How this one goes wrong
Specific to this question, not general advice.
- Answering as though you run the building. Describing badge readers and mantraps you have never seen reads as copied text, and it is.
- Leaving the question blank because it does not apply. It does apply; the answer is that the control is inherited, and naming the provider is the answer.
- Forgetting the office. If laptops or backups live somewhere with a door, the office half of this question is yours to answer.