For Data Center Operators · 4 min read ·
SOC 2 for Data Center Operators: Scope and Timeline
Data center SOC 2 reports focus on physical access, environmental controls and Availability. Your tenants rely on your report for the parts of their own audits that run in your building.
Your report becomes part of theirs
Tenants list you as a subservice organization in their own SOC 2. Their auditor will either carve your controls out and read your report, or include them directly. Either way, they need your report on time every year.
Controls auditors test in a data center
- Badge and biometric access, with visitor logs and escorts
- CCTV coverage and how long footage is kept
- Power, cooling and fire suppression, with maintenance records
- Quarterly reviews of who can enter each cage or suite
Add Availability to scope
Tenants buy uptime. Adding the Availability criterion lets the report cover capacity planning, redundancy and recovery testing.
Quick answers
SOC 2 covers security and uptime, which is what most tenants ask for. SOC 1 is only for controls over client financial reporting. Ezzi CaaS runs SOC 2 programs from $1,195 a month.
It depends on how fast evidence is gathered. For Type II, at least 3 months of evidence is needed before the audit can start.