The checklist below has 39 checks for a data centre physical security audit, grouped by the five boundaries from site to rack and then the plant and pathways that keep the facility running. Each row gives the check, the evidence to ask for, and the references in four standards: PSPF Release 2026 with ISM September 2026, the SOCI Act's CIRMP Rules s 11, ISO/IEC 27001:2022 Annex A.7, and SOC 2. It is free, needs no form, and prints from the browser.
The references are item-level. Where a row cites a PSPF requirement, a table or an ISM control, that reference is to the current edition. Where a column shows a dash, that standard has no direct item for the check; it may still be covered by a general control.
How to use this checklist
Walk the facility from outside in. A breach comes from the street, so an audit that starts at the rack and works out finds the gaps last. At each boundary, ask for the evidence in the row before you accept the answer, and record what you saw, not what you were told.
Score each row as met, partly met, not met, or not applicable, with one line saying why. "Not applicable" is a claim about scope, so give the reason: a facility with no Commonwealth customers can mark the PSPF column not applicable, but it cannot mark a check not applicable because the evidence is hard to find.
Three words are kept strictly in what follows. The five boundaries are the site perimeter, the building, the data hall, the cage and the rack. Layers means only the PSPF's five layers of physical security (deter, detect, delay, respond, recover) or the ISM's three layers. Zone plus a number means a PSPF Security Zone and nothing else.
Site perimeter
Fence line, gates, parking and standoff
Building
Entries, exits, emergency exits, air intakes, service ducts
Data hall
The zone the equipment's aggregated classification needs
Cage
A tenant's own fence inside the hall
Rack
A locked cabinet or SCEC-approved container
Plant and pathways
Mostly outside the halls, and often the easiest way in
- Power and generators
- Cooling
- Fuel
- Meet-me room
- Risers and cable paths
- Security control room
Site perimeter
Fence line, gates, parking and standoff
Building
Entries, exits, emergency exits, air intakes, service ducts
ISM layer 1 · ISM-0810
Data hall
The zone the equipment's aggregated classification needs
ISM layer 2 · ISM-1053
Cage
A tenant's own fence inside the hall
Rack
A locked cabinet or SCEC-approved container
ISM layer 3 · ISM-1530
Plant and pathways
Mostly outside the halls, and often the easiest way in
Power and generators · Cooling · Fuel · Meet-me room · Risers and cable paths · Security control room
To print it, use your browser's print command. The checklist prints as tables, one per boundary, with an empty square beside each check for ticking on paper. The six columns fit best on a horizontal page.
Which references apply to your facility
Not every column applies to every facility. Decide which ones bind you before the walk-through, because that decides which evidence you need.
| Reference | When it applies |
|---|---|
| PSPF Release 2026 | It binds Commonwealth entities. A commercial operator meets it through its government customers, who must host classified information on certified services (Requirement 0111) and place equipment in the right zone. |
| ISM September 2026 | ASD's control set for systems; its physical guidelines carry the three layers. It is not legally binding unless legislation or a direction requires it, and reaches operators through IRAP assessments and contracts. |
| CIRMP Rules s 11 | The facility is a critical data storage or processing asset under the SOCI Act, and no HCF Strategic certificate covers the services (s 30AB(4)). |
| ISO/IEC 27001:2022, A.7 | A certified management system covers the facility. Annex A has 14 physical controls, A.7.1 to A.7.14. |
| SOC 2, CC6.4, CC6.5, A1.2 | You, or a tenant whose auditor relies on your controls, has a SOC 2 report. |
| PCI DSS v4.0.1, Requirement 9 | Cardholder data is processed or stored in the facility. Map it at requirement level; v4.0.1 is the only active version since 31 December 2024. |
SOC 2 is written in US English, so its criterion talks about "data center facilities"; the checks here use the Australian spelling and mean the same rooms. Two ratings often appear in the same conversation and are not on the list. An Uptime Institute Tier grades topology and operational sustainability, and Uptime says its Tier standards do not cover security, although its Tier Certification scope lists physical security among its evaluation components. TIA-942-C (May 2024) covers physical security among its subsystems and rates facilities Rated-1 to Rated-4. Both are availability and resilience ratings, so neither replaces a row below.
The checklist
Site perimeter
The fence line, the gates and everything between the street and the building.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| S1 | The site was chosen, or has been reviewed, against the site selection factors: neighbourhood, standoff perimeter, site access and parking, building access points, Security Zones and environmental risks. | A dated site selection or site review record addressing each factor. | Req 0191 · Table 36 | s 11(1)(b) | A.7.1, A.7.5 | - |
| S2 | The perimeter is continuous: fences, gates and vehicle barriers have no gaps, and fencing is specified to a named standard. | Perimeter drawing with the fence specification (the PSPF names AS 1725.1 for chain-link and AS 3016 for electric fences) and a recent walk-down with photographs. | s 25.5 | s 11(1)(b) | A.7.1 | CC6.4 |
| S3 | Vehicle and pedestrian entry to the site, the parking area and any standoff perimeter is controlled. | Gate access logs for a sample week, the list of people who can open each gate, and the standoff assessment if a vehicle threat was identified. | Table 36 | s 11(1)(d) | A.7.1, A.7.2 | CC6.4 |
| S4 | Natural hazards for the site are identified, each with a measure: fire, flood, cyclone, storm, heatwave, earthquake and the rest of the CIRMP list. | A hazard register naming each hazard, the component it reaches, the measure in place and the review date. | Table 36 | s 11(1)(b), s 11(2)(d) | A.7.5 | A1.2 |
| S5 | The perimeter is monitored, and an alarm reaches someone who responds at any hour. | Camera coverage plan for the fence line and gates, alarm test records, and the response time measured at the last test. | s 23.2 · s 25.6 | s 11(1)(e) | A.7.4 | - |
S1
The site was chosen, or has been reviewed, against the site selection factors: neighbourhood, standoff perimeter, site access and parking, building access points, Security Zones and environmental risks.
Evidence to ask for
A dated site selection or site review record addressing each factor.
- PSPF / ISM
- Req 0191 · Table 36
- CIRMP s 11
- s 11(1)(b)
- ISO A.7
- A.7.1, A.7.5
- SOC 2
- -
S2
The perimeter is continuous: fences, gates and vehicle barriers have no gaps, and fencing is specified to a named standard.
Evidence to ask for
Perimeter drawing with the fence specification (the PSPF names AS 1725.1 for chain-link and AS 3016 for electric fences) and a recent walk-down with photographs.
- PSPF / ISM
- s 25.5
- CIRMP s 11
- s 11(1)(b)
- ISO A.7
- A.7.1
- SOC 2
- CC6.4
S3
Vehicle and pedestrian entry to the site, the parking area and any standoff perimeter is controlled.
Evidence to ask for
Gate access logs for a sample week, the list of people who can open each gate, and the standoff assessment if a vehicle threat was identified.
- PSPF / ISM
- Table 36
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.1, A.7.2
- SOC 2
- CC6.4
S4
Natural hazards for the site are identified, each with a measure: fire, flood, cyclone, storm, heatwave, earthquake and the rest of the CIRMP list.
Evidence to ask for
A hazard register naming each hazard, the component it reaches, the measure in place and the review date.
- PSPF / ISM
- Table 36
- CIRMP s 11
- s 11(1)(b), s 11(2)(d)
- ISO A.7
- A.7.5
- SOC 2
- A1.2
S5
The perimeter is monitored, and an alarm reaches someone who responds at any hour.
Evidence to ask for
Camera coverage plan for the fence line and gates, alarm test records, and the response time measured at the last test.
- PSPF / ISM
- s 23.2 · s 25.6
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- A.7.4
- SOC 2
- -
Building
The shell, its doors and every opening that is not a door. In the ISM's model, the first layer.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| B1 | Every building access point is secured, including emergency exits, air intakes and outlets, and service ducts. | The access point schedule from the facility security plan, door hardware specifications, and photographs of intakes and ducts. | Table 36 · Req 0190 | s 11(1)(d) | A.7.1, A.7.3 | CC6.4 |
| B2 | A facility security plan exists for the facility, and for every major refurbishment since. | The plan, its date, and the list of refurbishments and construction since it was written. | Req 0189, 0190 | s 11(2)(c) | A.7.3 | - |
| B3 | Visitors are registered, identified, escorted where the area requires it, and signed out. | Visitor log for a sample month, the written escort rule, and badge return records. | Table 37 | s 11(1)(d) | A.7.2 | CC6.4 |
| B4 | Access to areas holding physical critical components is limited to critical workers or accompanied visitors, and the critical worker list is current. | The critical worker list with roles, reconciled against the access control system's users. | Table 37 | s 11(1)(d) | A.7.2, A.7.6 | CC6.4 |
| B5 | The intruder alarm system is certified by the right person for the zone and graded for the impact level. | The alarm certificate (a suitably qualified installer for a commercial system in Zones One to Three; a SCEC-endorsed Security Zone consultant for a Type 1A system in Zones Four and Five) and the AS/NZS 2201.1 class. | Table 40 · s 25.6 | s 11(1)(e) | A.7.4 | - |
| B6 | Alarms are tested and maintained by an authorised provider. | Service records. The PSPF says preferably every two years, at a minimum. | s 25.6 | s 11(1)(e) | A.7.13 | - |
| B7 | Classified systems sit in a facility that meets the requirements of a zone suitable for their classification. | The zone certificate and accreditation for the area, with their dates. | ISM‑0810, ISM‑1973 · Req 0196, 0198 | - | A.7.1 | - |
B1
Every building access point is secured, including emergency exits, air intakes and outlets, and service ducts.
Evidence to ask for
The access point schedule from the facility security plan, door hardware specifications, and photographs of intakes and ducts.
- PSPF / ISM
- Table 36 · Req 0190
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.1, A.7.3
- SOC 2
- CC6.4
B2
A facility security plan exists for the facility, and for every major refurbishment since.
Evidence to ask for
The plan, its date, and the list of refurbishments and construction since it was written.
- PSPF / ISM
- Req 0189, 0190
- CIRMP s 11
- s 11(2)(c)
- ISO A.7
- A.7.3
- SOC 2
- -
B3
Visitors are registered, identified, escorted where the area requires it, and signed out.
Evidence to ask for
Visitor log for a sample month, the written escort rule, and badge return records.
- PSPF / ISM
- Table 37
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2
- SOC 2
- CC6.4
B4
Access to areas holding physical critical components is limited to critical workers or accompanied visitors, and the critical worker list is current.
Evidence to ask for
The critical worker list with roles, reconciled against the access control system's users.
- PSPF / ISM
- Table 37
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2, A.7.6
- SOC 2
- CC6.4
B5
The intruder alarm system is certified by the right person for the zone and graded for the impact level.
Evidence to ask for
The alarm certificate (a suitably qualified installer for a commercial system in Zones One to Three; a SCEC-endorsed Security Zone consultant for a Type 1A system in Zones Four and Five) and the AS/NZS 2201.1 class.
- PSPF / ISM
- Table 40 · s 25.6
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- A.7.4
- SOC 2
- -
B6
Alarms are tested and maintained by an authorised provider.
Evidence to ask for
Service records. The PSPF says preferably every two years, at a minimum.
- PSPF / ISM
- s 25.6
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- A.7.13
- SOC 2
- -
B7
Classified systems sit in a facility that meets the requirements of a zone suitable for their classification.
Evidence to ask for
The zone certificate and accreditation for the area, with their dates.
- PSPF / ISM
- ISM‑0810, ISM‑1973 · Req 0196, 0198
- CIRMP s 11
- -
- ISO A.7
- A.7.1
- SOC 2
- -
Data hall
The room the equipment lives in. In the ISM's model, the additional zone and the second layer.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| H1 | The hall's zone matches the aggregated classification or business impact level of what it holds, backups included. | The security risk assessment showing the aggregate, the zone chosen, and the Table 22 or Table 23 row relied on. | Req 0094 · Tables 22, 23 | - | A.7.3 | - |
| H2 | The server or communications room is an additional security zone inside the facility's zone. | The hall's own zone certificate, separate from the building's. | ISM‑1053, ISM‑1974 | - | A.7.3 | - |
| H3 | The zone was certified and accredited before use, and both are current. | The certification (CSO or delegate for Zones One to Four; ASIO-T4 for Zone Five areas holding TOP SECRET or catastrophic aggregates) and the accreditation, with the residual risks accepted and the expiry. | Req 0196, 0197, 0198 | - | - | - |
| H4 | Electronic access control has current software patches and no obsolete components, and was certified by a suitably qualified installer or designer. | The installer certificate, the current patch level, and vendor support dates for the head-end and readers. | Table 40 | s 11(1)(d) | A.7.2, A.7.13 | CC6.4 |
| H5 | Access to the hall is created, modified, removed and reviewed on a record. | Access requests with approvals, removals for a sample of leavers with dates, and the last two access reviews with the changes they made. | Table 37 | s 11(1)(d) | A.7.2 | CC6.4 |
| H6 | The hall is never left unsecured, and people without access cannot observe the systems inside. | Door-held-open alarm records, walk-down notes, and a sightline check from corridors and windows. | ISM‑0813 · ISM‑0164 | s 11(1)(d) | A.7.3, A.7.7 | CC6.4 |
| H7 | Cameras cover every door into the hall, and recordings are kept for the period the policy sets. | The camera schedule, the retention setting, and a retrieval test of a recording from the period. | s 23.2 | s 11(1)(e) | A.7.4 | - |
| H8 | Rules for working in the hall are written and followed. | The secure area rules, induction records for a sample of engineers and contractors, and any recorded breaches. | Table 37 | - | A.7.6 | - |
| H9 | Recertification triggers are logged: expiry, a change in business impact level, a significant change to the architecture or controls, or a condition the accreditor set. | The trigger log and the change records it draws on. | s 24.2.3 | - | - | - |
H1
The hall's zone matches the aggregated classification or business impact level of what it holds, backups included.
Evidence to ask for
The security risk assessment showing the aggregate, the zone chosen, and the Table 22 or Table 23 row relied on.
- PSPF / ISM
- Req 0094 · Tables 22, 23
- CIRMP s 11
- -
- ISO A.7
- A.7.3
- SOC 2
- -
H2
The server or communications room is an additional security zone inside the facility's zone.
Evidence to ask for
The hall's own zone certificate, separate from the building's.
- PSPF / ISM
- ISM‑1053, ISM‑1974
- CIRMP s 11
- -
- ISO A.7
- A.7.3
- SOC 2
- -
H3
The zone was certified and accredited before use, and both are current.
Evidence to ask for
The certification (CSO or delegate for Zones One to Four; ASIO-T4 for Zone Five areas holding TOP SECRET or catastrophic aggregates) and the accreditation, with the residual risks accepted and the expiry.
- PSPF / ISM
- Req 0196, 0197, 0198
- CIRMP s 11
- -
- ISO A.7
- -
- SOC 2
- -
H4
Electronic access control has current software patches and no obsolete components, and was certified by a suitably qualified installer or designer.
Evidence to ask for
The installer certificate, the current patch level, and vendor support dates for the head-end and readers.
- PSPF / ISM
- Table 40
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2, A.7.13
- SOC 2
- CC6.4
H5
Access to the hall is created, modified, removed and reviewed on a record.
Evidence to ask for
Access requests with approvals, removals for a sample of leavers with dates, and the last two access reviews with the changes they made.
- PSPF / ISM
- Table 37
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2
- SOC 2
- CC6.4
H6
The hall is never left unsecured, and people without access cannot observe the systems inside.
Evidence to ask for
Door-held-open alarm records, walk-down notes, and a sightline check from corridors and windows.
- PSPF / ISM
- ISM‑0813 · ISM‑0164
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.3, A.7.7
- SOC 2
- CC6.4
H7
Cameras cover every door into the hall, and recordings are kept for the period the policy sets.
Evidence to ask for
The camera schedule, the retention setting, and a retrieval test of a recording from the period.
- PSPF / ISM
- s 23.2
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- A.7.4
- SOC 2
- -
H8
Rules for working in the hall are written and followed.
Evidence to ask for
The secure area rules, induction records for a sample of engineers and contractors, and any recorded breaches.
- PSPF / ISM
- Table 37
- CIRMP s 11
- -
- ISO A.7
- A.7.6
- SOC 2
- -
H9
Recertification triggers are logged: expiry, a change in business impact level, a significant change to the architecture or controls, or a condition the accreditor set.
Evidence to ask for
The trigger log and the change records it draws on.
- PSPF / ISM
- s 24.2.3
- CIRMP s 11
- -
- ISO A.7
- -
- SOC 2
- -
Cage
A tenant's own enclosure inside the hall. Most tenant audit questions land here.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| C1 | Each cage has its own lock or credential, separate from the hall's. | The cage key or credential register, by tenant. | ISM‑1074 | - | A.7.3 | CC6.4 |
| C2 | The operator holds each tenant's authorised list for its cage, and the tenant reviews that list on a schedule. | The tenant's authorised list, the tenant's dated review confirmations, and the operator's record of changes made from them. | - | - | A.7.2 | CC6.4 |
| C3 | Keys and equivalent access mechanisms are issued, returned and audited, and lost keys lead to lock or code changes. | The key register, the last key audit, and lost-key records with the changes they caused. | ISM‑1074 | s 11(1)(d) | A.7.2 | CC6.4 |
| C4 | Escorted work in a cage is recorded: who, when, for whom and under which ticket. | The escort log reconciled against change or access tickets for a sample week. | Table 37 | s 11(1)(d) | A.7.2 | CC6.4 |
C1
Each cage has its own lock or credential, separate from the hall's.
Evidence to ask for
The cage key or credential register, by tenant.
- PSPF / ISM
- ISM‑1074
- CIRMP s 11
- -
- ISO A.7
- A.7.3
- SOC 2
- CC6.4
C2
The operator holds each tenant's authorised list for its cage, and the tenant reviews that list on a schedule.
Evidence to ask for
The tenant's authorised list, the tenant's dated review confirmations, and the operator's record of changes made from them.
- PSPF / ISM
- -
- CIRMP s 11
- -
- ISO A.7
- A.7.2
- SOC 2
- CC6.4
C3
Keys and equivalent access mechanisms are issued, returned and audited, and lost keys lead to lock or code changes.
Evidence to ask for
The key register, the last key audit, and lost-key records with the changes they caused.
- PSPF / ISM
- ISM‑1074
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2
- SOC 2
- CC6.4
C4
Escorted work in a cage is recorded: who, when, for whom and under which ticket.
Evidence to ask for
The escort log reconciled against change or access tickets for a sample week.
- PSPF / ISM
- Table 37
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.2
- SOC 2
- CC6.4
Rack
The container. In the ISM's model, the third layer.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| R1 | Racks are the container the zone requires: a lockable commercial cabinet, or the SCEC class that Table 22 or Table 23 sets. | The rack specification and, where a SCEC class is required, the SCEC approval. | Tables 22, 23 · s 25.1 · ISM‑1530, ISM‑1975 | - | A.7.8 | - |
| R2 | TOP SECRET equipment sits in SCEC-endorsed racks or compartments inside an accredited Zone Five area. | The Zone Five accreditation and the rack or compartment approvals. | Req 0095 | - | A.7.8 | - |
| R3 | Rack locks and their keys or codes are controlled like any other access mechanism. | The rack key or code register and its last audit. | ISM‑1074 | - | A.7.8 | CC6.4 |
| R4 | IT equipment and media are secured when not in use, and media is stored to its classification. | The media register and the storage location for a sample of items. | ISM‑0161 | - | A.7.10 | - |
| R5 | Equipment leaving for repair or disposal has its data removed first, and protection over it ends only once data cannot be recovered. | Removal authorisations, and sanitisation or destruction certificates matched to asset tags. | - | - | A.7.9, A.7.14 | CC6.5 |
R1
Racks are the container the zone requires: a lockable commercial cabinet, or the SCEC class that Table 22 or Table 23 sets.
Evidence to ask for
The rack specification and, where a SCEC class is required, the SCEC approval.
- PSPF / ISM
- Tables 22, 23 · s 25.1 · ISM‑1530, ISM‑1975
- CIRMP s 11
- -
- ISO A.7
- A.7.8
- SOC 2
- -
R2
TOP SECRET equipment sits in SCEC-endorsed racks or compartments inside an accredited Zone Five area.
Evidence to ask for
The Zone Five accreditation and the rack or compartment approvals.
- PSPF / ISM
- Req 0095
- CIRMP s 11
- -
- ISO A.7
- A.7.8
- SOC 2
- -
R3
Rack locks and their keys or codes are controlled like any other access mechanism.
Evidence to ask for
The rack key or code register and its last audit.
- PSPF / ISM
- ISM‑1074
- CIRMP s 11
- -
- ISO A.7
- A.7.8
- SOC 2
- CC6.4
R4
IT equipment and media are secured when not in use, and media is stored to its classification.
Evidence to ask for
The media register and the storage location for a sample of items.
- PSPF / ISM
- ISM‑0161
- CIRMP s 11
- -
- ISO A.7
- A.7.10
- SOC 2
- -
R5
Equipment leaving for repair or disposal has its data removed first, and protection over it ends only once data cannot be recovered.
Evidence to ask for
Removal authorisations, and sanitisation or destruction certificates matched to asset tags.
- PSPF / ISM
- -
- CIRMP s 11
- -
- ISO A.7
- A.7.9, A.7.14
- SOC 2
- CC6.5
Plant and pathways
Power, cooling, fuel, the meet-me room, the risers and the security control room. Mostly outside the halls, and what stops the facility if it fails.
| Check | Evidence to ask for | PSPF / ISM | CIRMP s 11 | ISO A.7 | SOC 2 | |
|---|---|---|---|---|---|---|
| P1 | The physical critical components are listed, with the plant and pathways the halls depend on. | The dated critical component list in the risk management program. | - | s 11(1)(a), s 11(2)(a) | A.7.11 | - |
| P2 | Power, cooling and fuel have their own access control and alarms, separate from the halls. | Plant room access lists and the alarm points on generator, fuel and cooling areas. | - | s 11(1)(b), (d) | A.7.11 | A1.2 |
| P3 | Cabling between rooms and to carriers is protected, and network devices in public or shared areas are secured. | Riser and pathway drawings, and the locks on network equipment in shared paths. | ISM‑1296 | s 11(1)(b) | A.7.12 | - |
| P4 | The meet-me room is a controlled area with its own access list, and carrier staff are escorted. | The meet-me room access list and carrier escort records for a sample month. | - | s 11(1)(d) | A.7.3, A.7.12 | CC6.4 |
| P5 | The security control room is itself protected, and monitoring continues through business hours and out of hours. | The control room access list, the roster showing cover at all hours, and the failover for monitoring. | s 23.2 | s 11(1)(e) | A.7.4 | - |
| P6 | Plant and security systems are maintained to schedule by authorised people. | Maintenance records and contractor access records for the same dates. | Table 40 | s 11(1)(b) | A.7.13 | A1.2 |
| P7 | A procedure covers unauthorised access to any critical component, and it has been used or rehearsed. | The procedure, the last exercise record, and any incident records since. | s 23.2 | s 11(1)(c) | - | - |
| P8 | The arrangements have been tested to detect, delay, deter, respond to and recover from a breach. | A test plan and dated results for each of the five. | s 23.2 | s 11(1)(e) | - | - |
| P9 | Where government customers rely on HCF certification, physical access security and the other core capabilities have not changed without the approval the certificate requires. | The Relevant Change log and the approvals behind it. | Req 0111 | - | - | - |
P1
The physical critical components are listed, with the plant and pathways the halls depend on.
Evidence to ask for
The dated critical component list in the risk management program.
- PSPF / ISM
- -
- CIRMP s 11
- s 11(1)(a), s 11(2)(a)
- ISO A.7
- A.7.11
- SOC 2
- -
P2
Power, cooling and fuel have their own access control and alarms, separate from the halls.
Evidence to ask for
Plant room access lists and the alarm points on generator, fuel and cooling areas.
- PSPF / ISM
- -
- CIRMP s 11
- s 11(1)(b), (d)
- ISO A.7
- A.7.11
- SOC 2
- A1.2
P3
Cabling between rooms and to carriers is protected, and network devices in public or shared areas are secured.
Evidence to ask for
Riser and pathway drawings, and the locks on network equipment in shared paths.
- PSPF / ISM
- ISM‑1296
- CIRMP s 11
- s 11(1)(b)
- ISO A.7
- A.7.12
- SOC 2
- -
P4
The meet-me room is a controlled area with its own access list, and carrier staff are escorted.
Evidence to ask for
The meet-me room access list and carrier escort records for a sample month.
- PSPF / ISM
- -
- CIRMP s 11
- s 11(1)(d)
- ISO A.7
- A.7.3, A.7.12
- SOC 2
- CC6.4
P5
The security control room is itself protected, and monitoring continues through business hours and out of hours.
Evidence to ask for
The control room access list, the roster showing cover at all hours, and the failover for monitoring.
- PSPF / ISM
- s 23.2
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- A.7.4
- SOC 2
- -
P6
Plant and security systems are maintained to schedule by authorised people.
Evidence to ask for
Maintenance records and contractor access records for the same dates.
- PSPF / ISM
- Table 40
- CIRMP s 11
- s 11(1)(b)
- ISO A.7
- A.7.13
- SOC 2
- A1.2
P7
A procedure covers unauthorised access to any critical component, and it has been used or rehearsed.
Evidence to ask for
The procedure, the last exercise record, and any incident records since.
- PSPF / ISM
- s 23.2
- CIRMP s 11
- s 11(1)(c)
- ISO A.7
- -
- SOC 2
- -
P8
The arrangements have been tested to detect, delay, deter, respond to and recover from a breach.
Evidence to ask for
A test plan and dated results for each of the five.
- PSPF / ISM
- s 23.2
- CIRMP s 11
- s 11(1)(e)
- ISO A.7
- -
- SOC 2
- -
P9
Where government customers rely on HCF certification, physical access security and the other core capabilities have not changed without the approval the certificate requires.
Evidence to ask for
The Relevant Change log and the approvals behind it.
- PSPF / ISM
- Req 0111
- CIRMP s 11
- -
- ISO A.7
- -
- SOC 2
- -
What good evidence looks like
Good evidence is dated, names a person, and comes from a sample the auditor chose. An access review that lists who was removed and who approved the result is evidence; a policy that says reviews happen quarterly is not. An alarm service record from an authorised provider, a zone certificate with its expiry, an installer's certificate that confirms current patches, and a test result for each of the five verbs all carry their own date, which is what makes them hold up.
SOC 2 deserves one note. Criterion CC6.4 restricts physical access to facilities and protected information assets to authorised personnel, and its points of focus are creating or modifying, removing, and reviewing that access. It names no device. A SOC 2 auditor will test the lifecycle, so the evidence for H5 and C2 matters more than the camera count.
For the SOCI column, CIRMP Rules s 11(2) asks the entity to have regard to whether the program itself describes the critical components, the physical security hazards, the security arrangements and the natural hazards, so ask for the program, not only the site documents. The SOCI physical security post covers what each paragraph of s 11 asks.
Five gaps to look for first
These are the places where a facility that passes the hall walk-through often fails the full walk.
- Plant rooms on a looser access list than the halls. A generator room or fuel store that any contractor badge opens is a shorter way to stop the facility than any hall door.
- Tenant lists that nobody reviews. The operator holds the list, the tenant assumes the operator checks it, and the SOC 2 auditor asks for the review that neither party did.
- An access control head-end out of vendor support. Table 40 asks for current patches and no obsolete components, and an unsupported head-end fails both.
- Alarms that alert nobody at night. A control room roster with a gap turns detect into record.
- Escort rules that stop at the hall door. The riser, the meet-me room and the roof plant are on the same routes, and s 11(1)(d) covers every physical critical component.
Who signs off what
An audit finds and records; it does not certify. Under PSPF Release 2026, the Commonwealth entity's CSO or delegate certifies and accredits Zones One to Four, ASIO-T4 certifies Zone Five areas holding TOP SECRET or catastrophic aggregates, a suitably qualified installer or designer certifies commercial alarms and access control, and a SCEC-endorsed Security Zone consultant certifies a Type 1A alarm in Zones Four and Five. An accredited certification body issues an ISO 27001 certificate, a CPA firm attests a SOC 2 report, and a PCI DSS assessment is a Qualified Security Assessor's or a self-assessment. The PSPF security zones guide covers the zone signatures in full, and the HCF guide covers the certification government customers ask about.
If you want the walk done for you, our data centre physical security practice assesses a facility against the regimes that apply, designs the boundaries and prepares the evidence each certifier reads, with the certificate left to the authority each regime names.