A company runs a hybrid cloud. Most workloads are in a public cloud, but a small on-premises server room hosts identity servers and the routers for private connectivity to the cloud. The provider's SOC 2 report shows strong physical controls. What is true about physical and environmental protection for the server room?

In a hybrid deployment, responsibility for physical and environmental protection follows ownership of the facility. A provider's SOC 2 report describes controls within its defined system boundary, its own data centers, and gives no assurance about a customer's premises. The on-premises room therefore needs the organization's own controls: restricted and logged physical access, locked racks, environmental monitoring for temperature, humidity and water, fire detection and suppression appropriate to equipment, and conditioned and protected power. These assets are high value, since identity servers and connectivity routers sit on the critical path for the whole hybrid environment. A network connection does not extend an attestation's scope; scope is fixed by the service auditor's report, and the room is outside it. MFA and encryption protect logical access, but someone with physical access can remove disks, cut power, attach devices or destroy hardware, defeating logical controls. Failover to the cloud may not be possible if identity and connectivity components fail, because cloud workloads often depend on them, and omitting environmental controls invites precisely that outage. Exam caveat: the shared responsibility model applies per environment; on-premises portions remain wholly the customer's. Operational check: walk the room against the physical security baseline and confirm monitoring alerts reach the operations team.