Physical security questions for a small or remote team
Physical security questions are written for companies with server rooms. A small team that works from offices and home offices on cloud providers can answer them in a sentence each.
What the client wants to know
The client wants to know where their data physically lives, who can walk up to it and whether it ever leaves on paper or a USB stick. If you have no on-site servers, say so plainly. That is a reassuring answer, not a missing control.
The 3 questions as clients phrase them
The kit covers 3 questions in this area. The wording varies between questionnaires, the control behind it does not.
- How do you secure your offices or workplaces?
- Do you operate your own data centre?
- Is our data printed or stored on removable media?
What a good answer contains
- Workplaces: offices and home offices without on-site servers, client data with hosting providers whose data centres are covered by their own certifications, laptops locked when unattended.
- Data centre: you do not operate your own. Name the hosting providers.
- Paper and removable media: by default client data is neither printed nor copied to USB drives, unless the engagement requires it and the client agrees.
Watch out for
Do not quote a provider's certification you have not seen. Link to the provider's own security page or ask for the report under their terms.
Example: how a prepared answer opens
Question: How do you secure your offices or workplaces?
[your company] works from offices and home offices without on-site servers.
This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.