For a small data center, SOC 2 preparation should follow the service you operate. Start with what customers rely on you to protect and keep running. Then assign the work and retain evidence that it happens.
This guide covers a practical control program for a facility operator. A company renting space has a different job: it must manage its equipment and review the facility provider’s work. The examples below help explain both sides without treating them as the same service.
Define the service before the controls
List the facilities and services intended for the report. Colocation space is not the same as managed hosting. Supplying power and cooling does not mean you also back up a customer’s application.
- Describe which rooms, support systems and operating teams deliver the service.
- State the security and service commitments you make to customers.
- Identify responsibility for customer equipment, networks and data.
- Confirm the relevant Trust Services categories with the CPA firm. Do not assume every category belongs in every report.
SOC 2 addresses the selected Trust Services criteria. SOC 1 has a different purpose: controls relevant to customers’ financial reporting. A customer’s request should be understood before deciding which examination to undertake.
Assign owners and an operating routine
Give someone overall responsibility for the program. Assign facilities operations, security and IT tasks to the people who can actually perform them. Name backup coverage for work that cannot wait for one person to return.
Keep a short risk list tied to this facility. Consider unauthorized entry and failures of the systems that keep equipment running. Include dependencies such as maintenance contractors and fuel delivery where they matter to your service.
An operating review should examine overdue work, recent incidents and unresolved risks. Choose a frequency that fits the service and its commitments. Record decisions and follow-up rather than turning every meeting into a long compliance report.
Build access and monitoring into ordinary work
A useful control says what someone does. Useful evidence shows that it happened. These four examples can use the tickets and system records you already keep. Adapt the deadlines and procedures to the facility rather than copying them as universal requirements.
Approve access to the right area
Example control wording: The facilities owner approves the person and permitted areas before security activates a badge.
- Evidence to keep: The approved request and the badge-system record showing the areas granted.
- Check: Approval for the building does not automatically justify access to every cage or equipment room.
Remove access when it ends
Example control wording: Security disables the badge at the authorized access end time. The responsible manager supplies that time through the departure or access-change process.
- Evidence to keep: The end-time instruction and the system record of badge deactivation. Keep follow-up for any late removal.
- Check: Collecting a plastic badge is not the same as disabling it. Confirm the access is no longer usable.
If your process uses a different deadline, write that deadline accurately. Decide it from the risk and applicable commitments rather than copying this example blindly.
Control a visitor’s access
Example control wording: Security confirms the visitor’s approval before entry. A named escort accompanies visitors in restricted areas. Temporary access ends when the visit closes.
- Evidence to keep: The visit approval and a record of entry and departure. Identify the escort and any temporary badge issued.
- Check: Use this wording only where escorting is your actual rule. An unescorted authorized technician needs the controls that apply to that arrangement.
Respond to environmental alerts
Example control wording: The monitoring system routes temperature alerts outside approved limits to the duty facilities team. The team records its assessment and tracks corrective work to closure.
- Evidence to keep: The approved limits and routing setup. For an alert, keep its timestamp and the response record. Link any repair and confirmation that conditions returned to acceptable limits.
- Check: A sensor screenshot does not show that anyone receives its alerts. Use a safe approved test to check routing and label the result as a test.
Set limits with the people responsible for the equipment and facility. This example does not prescribe one temperature range for every room.
Maintain equipment and control changes
A maintenance calendar should reflect the equipment you depend on and the applicable service requirements. Assign each job and review unfinished work. A contractor visit does not establish that the required maintenance was completed.
- Keep the equipment list and maintenance results together.
- Review planned work for effects on customer service and redundancy.
- Approve changes to facility systems and management networks through a defined process.
- Record the outcome and any defects. Set an owner and next step for unresolved work.
Example: Before work on a power component, the facilities lead reviews the planned impact and recovery arrangements. Afterward, the team records the completed checks and any remaining limitation. Qualified personnel determine safe procedures; an audit checklist is not an electrical work instruction.
Protect the systems used to run the building
Physical security is only part of the program. The badge system, environmental monitoring and remote management tools also need controlled access.
- Identify the accounts and devices that can change facility settings.
- Give staff and contractors only the access needed for their work.
- Track remote support and remove access that is no longer required.
- Manage updates and vulnerabilities with the equipment’s safety and operating constraints in mind.
Evidence to keep: Access approvals and reviews, change records and unresolved vulnerability decisions. Do not install an update on a critical control system merely to clear a dashboard warning. Assess the risk and agree a safe treatment.
Test response and recovery
An alert is a starting point, not a completed response. Define who assesses it and when the team escalates. Explain when customers will hear about a service problem and who makes that communication.
Test recovery against the service promised. For a colocation operator, that may focus on restoring facility support. A managed hosting service may also need to recover customer systems or data. Do not claim the second outcome because the first test passed.
- Use approved exercises and safe tests with clear success criteria.
- Include unavailable staff or important suppliers where relevant.
- Record what actually happened and compare it with the intended result.
- Fix gaps and retest the parts that failed.
A documented recovery plan is useful. Evidence that the plan works is stronger. Never disrupt a live facility simply to create audit evidence.
If a provider operates the building
Separate your responsibilities from the provider’s. You might approve your staff’s cage access while the provider operates the badge system and cooling.
Keep the relevant provider assurance and your review of it. Check the facilities and period covered. Retain your own approvals and follow-up too. Do not describe the provider’s work as something your team performs.
Review suppliers and customer handoffs
A facility operator may rely on security staff, maintenance firms and telecommunications providers. Identify which relationships could prevent you from meeting your commitments. Review their responsibilities and available assurance. Track concerns through to a decision.
Make customer responsibilities explicit too. If customers approve their own authorized personnel, explain how they send changes and how your team acts on them. If they own backups, do not imply that buying space includes a recovery service.
Keep evidence proportionate
For each control, record the owner and when the task occurs. Link to the evidence already produced by the work. Keep the result and follow-up when something went wrong.
A maintenance ticket can contain the instruction and completion record. An access review can show which accounts were checked and what changed. Avoid copying the same records into several trackers.
Agree retention and access restrictions with those responsible for records and the audit. Keep sensitive facility details out of broadly shared folders. A Type 2 examination needs evidence of operation over the report period, not just a policy written at the end.
How this connects to SOC 2
The AICPA Trust Services Criteria address governance and risk assessment as well as technical controls. Physical access sits within the common criteria. When Availability is in scope, the additional criteria address capacity, environmental protection and recovery testing. The procedures here are practical examples, not mandatory AICPA wording or a complete readiness assessment.
Before commissioning the examination, walk through the service with the CPA firm. Confirm the boundary and identify missing controls or evidence. Start with the highest-risk gaps while keeping ordinary operations working.
For a different operating model, see SOC 2 for a small managed IT provider. The same report label does not make the underlying service responsibilities identical.