A bank evaluating a public cloud provider asks to send its own auditors to inspect the physical controls at the provider's data centers. The provider declines, citing its security policy and the number of customers it serves. How should the bank obtain assurance about the provider's physical environment?
Select an answer to reveal the explanation.
Short Explanation
Picture thousands of customers all wanting a tour of the same building; it'd be chaos and a security risk on its own. That's why providers lean on independent auditors, and you rely on their reports. Watch the trap about shared responsibility, because the provider runs the physical layer while you still own the job of verifying it.
Full Explanation
In public cloud, the physical environment is controlled entirely by the provider, and direct customer inspections are usually refused because allowing every customer onsite would itself weaken security. The accepted mechanism is reliance on independent third-party assurance. A SOC 2 Type II report examines whether controls, including physical and environmental ones, operated effectively over a period, and ISO/IEC 27001 certification shows the provider runs an audited information security management system whose scope covers the facilities. The customer reviews scope, exceptions and complementary user entity controls. Requesting photographs and floor plans produces sensitive information that increases risk if leaked, and pictures show nothing about whether controls operate consistently over time. Accepting published security statements without verification ignores the principle that the customer remains accountable for its due diligence even when operation is delegated. Installing the bank's own cameras in a multi-tenant facility is impractical, would expose other tenants, and is not something providers permit. Exam caveat: shared responsibility allocates operational duties, but accountability for the data stays with the customer. Operational check: confirm the attestation's scope lists the regions hosting the bank's workloads and that the report period is current.