5 ms·
The SSAE 16 SOC 2 attestation would address physical access controls. At my last job with a hosting company, as an Engineer with substantial infrastructure in m
by tbyehl 13y ago
The SSAE 16 SOC 2 attestation would address physical access controls. At my last job with a hosting company, as an Engineer with substantial infrastructure in my local DC, I was not allowed entry without signing in and being issued a temporary DC badge. The whole industry probably isn't there yet, but auditors are cracking down on who is allowed unrestricted physical access and without that certification you cannot get big business customers.
- toomuchtodo 13y agoSigning in with a badge does't prevent you from smuggling data out on a USB stick.
- tbyehl 13y agoI've been in call centers that attempted to screen for storage devices via metal detectors and x-ray machines, but that's certainly not the norm for data centers. I know of customers of my former employer who would not provide system passwords and utilized disk encryption, but I have my doubts that their key management practices completely protected against someone with physical access. Ultimately if you're hosting somewhere that you don't control your primary defense is reputational risk and lawsuits.