Physical security across frameworks: the topic cloud-first companies forget
Most security teams now run everything in the cloud and rarely think about locks and cameras. Most frameworks still require them, and auditors still ask.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Physical security has become the forgotten topic of modern security programmes. Workloads run in someone else's data centre, staff work from home, and the office is mostly desks and coffee. Yet most frameworks still require physical controls, and when we audited our own mappings it turned out to be under-mapped, so we gave it a topic of its own.
Who requires what
| Framework | Physical Security | Link |
|---|---|---|
| NIST CSF 2.0 | PR.AA-06DE.CM-02PR.IR-02 | Topic definition |
| ISO 27001 | A.7.1A.7.2A.7.3A.7.4A.7.5A.7.8A.7.11A.7.6A.7.12 | Crosswalk |
| CIS v8.1 | — | No mapping in our data |
| SOC 2 | CC6.4 | Editorial |
| PCI DSS | 9.2.19.2.39.3.19.2.1.19.3.1.19.3.2 | Crosswalk |
| CMMC | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3PE.L2-3.10.4PE.L2-3.10.5PE.L2-3.10.6 | Crosswalk |
| 800-53 | PE-2PE-3PE-6PE-8PE-13PE-14 | Crosswalk |
| HIPAA | §164.310(a)§164.310(a)(2)(ii)§164.310(a)(2)(iii)§164.310(b)§164.310(c) | Crosswalk |
| GDPR | — | No mapping in our data |
| NIS2 | 13.113.213.3 | Crosswalk |
| Essential Eight | — | No mapping in our data |
Full detail and the reason for every link: Physical Security across frameworks →
The frameworks that care most
PCI DSS is the most detailed: entry controls for facilities with cardholder data systems, monitoring of sensitive areas with cameras or access control systems, visitor authorisation and logs, restricted network jacks and hardware, secure media storage and destruction, and inspection of card-reading devices for tampering (Requirement 9). CMMC Level 2 has a whole family: limit and monitor physical access, escort visitors, keep access logs, manage access devices and safeguard CUI at alternate work sites (PE.L2-3.10.1 to 3.10.6). ISO 27001 has fourteen physical controls in its A.7 theme, from perimeters and entry controls to clear desk, equipment maintenance and secure disposal. HIPAA has a full set of physical safeguards in §164.310.
The ones that don't
The CIS Controls dropped physical security in version 8. GDPR and the Essential Eight don't address it. SOC 2 covers it in a single criterion (CC6.4), and auditors of cloud-only companies often accept the cloud provider's own report for it.
What auditors ask a cloud-first company
Expect a short list of questions even when you own no servers:
- Which cloud and colocation providers host your systems, and where is their assurance report?
- How do you control access to your offices, and who has keys or badges?
- Are visitors signed in and escorted where sensitive information is visible?
- How are laptops protected if lost or stolen (encryption, remote wipe, a reporting process)?
- How are drives, laptops and paper disposed of?
Clear answers with a little evidence (badge system export, visitor log, MDM report, disposal certificates) usually close the topic quickly.
Key takeaways
- Most frameworks still require physical controls.
- Cloud-first companies inherit data-centre assurance and secure offices, laptops and media.
- Card-present payments bring PCI's physical requirements back into scope.
- PCI DSS is the most detailed, down to visitor logs and inspecting card readers for tampering.
Meeting it without a data centre
For a company with no servers of its own, physical security comes down to four things:
- Inherit the data centre. Your cloud provider's SOC 2 report or ISO certificate covers its facilities. Read the scope, and record in your own documentation that you rely on it.
- Secure your office proportionately. Badge access, visitor sign-in, locked storage for anything sensitive, and a clear desk policy (ISO A.7.7).
- Treat laptops as the perimeter. Full-disk encryption, screen locks, remote wipe and a process for lost devices cover most of what physical controls once did.
- Handle media and disposal. Wipe or destroy drives and devices before reuse or disposal (ISO A.7.14, PCI 9.4.7, HIPAA §164.310(d)).
If you take card payments in person, read PCI DSS Requirement 9 carefully: card-reading devices at the point of sale bring physical controls back into scope however cloud-native you are.
The Physical Security topic page lists every requirement with its source, and the gap analysis shows what a new framework adds to the one you have.
Questions
Do the CIS Controls cover physical security?
No. CIS Controls v8 removed physical security, which is why it has no mapping for this topic.
How do cloud-only companies meet physical security requirements?
By relying on their cloud provider's assurance for data centres (for example its SOC 2 report or ISO certificate) and covering their own offices, devices, media and visitors.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.