SIG Lite
Control PHY-01
Extractive Review Standard
How to answer 'Describe your physical security controls' on a SIG Lite when you're cloud-only
Reviewer Guidance & Pitfalls
State clearly that all infrastructure is hosted in accredited cloud provider datacenters (AWS/GCP/Azure) and inherit their audited physical security controls (biometric access, 24/7 CCTV, armed guards). For remote corporate offices, mention clean desk and badge access.
Example Answer Passing Enterprise Audit
Compliant Response Template
All production infrastructure is hosted in [AWS] facilities, inheriting their ISO 27001 and SOC 2 physical security controls; our corporate offices enforce keycard access and clean-desk policies (SOC 2, CC6.4).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.