How to answer 'Describe your physical security controls' on a SIG Lite when you're cloud-only
I. Reviewer Guidance & Pitfalls
State clearly that all infrastructure is hosted in accredited cloud provider datacenters (AWS/GCP/Azure) and inherit their audited physical security controls (biometric access, 24/7 CCTV, armed guards). For remote corporate offices, mention clean desk and badge access.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · PHY-01
All production infrastructure is hosted in [AWS] facilities, inheriting their ISO 27001 and SOC 2 physical security controls; our corporate offices enforce keycard access and clean-desk policies (SOC 2, CC6.4).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default