SOC 2 for fully remote companies: what auditors check

Updated 27 October 2026

Being fully remote does not take physical security out of a SOC 2 examination; it moves it from the office to each person's laptop and home. Linford & Co says CC6.4 still applies, while one IT services firm says there is "no requirement for physical security". This guide shows that disagreement, then covers what auditors check on devices, home offices and cloud providers, and the remote work clauses you can adopt. The sources are firms that sell compliance help, so ask your CPA firm and write down the answer.

Short answer, and where sources disagree

Linford & Co (a CPA firm) writes that SOC 2 "explicitly covers physical security under Common Criteria 6.4" and that for a remote company it "requires securing the distributed endpoints used to access corporate data" (Linford, 3 Jun 2026). ITJones, an IT services firm that sells a compliance program, writes "there is no requirement for physical security" and explains that without a central office a company need not guard against tailgating(ITJones). The page carries no year, and it does not name a replacement control.

The two readings reconcile if you split the term: door badges and visitor logs drop away without an office, but the criterion about restricting physical access to facilities and protected assets still has to be answered for the devices and the places they are used. Read CC6.4 and put your answer in the system description.

What moves from the office to the endpoint

Linford lists four things auditors look for in a remote-first company (Linford):

1. Endpoint management. Auditors review the MDM dashboard; full-disk encryption is enforced and cannot be turned off by users, and screens lock after a maximum of 10 to 15 minutes of inactivity.
2. Signed remote work policies. A log showing every person completed the policy, covering home Wi-Fi, clean-desk habits and public networks.
3. Central asset tracking. Offboarding is digital: HR termination lists are compared with the hardware inventory, and devices can be wiped remotely.
4. Identity and conditional access. The identity platform is the access boundary, backed by logging and alerts on risky administrative actions.

Schneider Downs adds that a move to a fully remote workforce can widen the control environment more than expected, and recommends a risk assessment for remote-specific gaps, such as removable media, local administrator rights and VPN split tunneling (Schneider Downs, 30 Mar 2020). It was written in the early months of the pandemic, so treat it as a checklist of ideas, not current practice.

What the cloud provider covers and what you still owe

Linford says that on a major cloud provider you inherit its physical security, but "simply having a vendor's SOC report isn't enough": keep a documented annual review of the report, identify the complementary user entity controls in it, and show you perform your share (Linford). The vendor reports guide covers collecting the reports, the reading guide covers what to look for in one, and the CUEC guide covers the controls it hands to you.

A remote work policy people sign

The generator asks about your work model and writes different wording for remote and hybrid teams. These are items of the generated Physical and Remote Work Security Policy for a remote team. Workspace privacy (item 4.6):

Personnel working from home maintain a workspace where screens cannot be observed by household members or visitors during work involving company or customer information, and use headphones for calls where others could overhear. Company devices are used only by the person they are assigned to.

Home network (item 4.7):

Home networks used for work are protected with WPA2 or WPA3 encryption and a strong, non-default Wi-Fi password; the router's administrative password is changed from the factory default and its firmware is kept up to date. Work devices are not connected to open networks or networks using WEP.

Untrusted networks (item 4.8):

On public or untrusted networks (hotels, airports, cafés, coworking spaces) personnel do not access production systems, administrative consoles or customer data unless the connection goes through the company VPN or an identity-aware proxy that encrypts all traffic and verifies the device. A personal hotspot is preferred over open public Wi-Fi.

And the setup step with its record (item 5.5):

Remote work setup. At onboarding, and whenever a person's primary work location changes, People Operations issues the home-office checklist covering workspace privacy, Wi-Fi security, router configuration and equipment storage. The person confirms completion in writing for the personnel record. Owner: People Operations. Cadence: at onboarding and on change of location; re-confirmed annually.

The written confirmation in 5.5 is the evidence. Collect it at onboarding with the onboarding and offboarding checklist, and log each signature the way the acknowledgment guide describes. The employee security handbook gives staff a plain-language version.

Devices: encryption, screen lock and updates

Konfirmity says devices must run supported operating systems with full-disk encryption, and calls screen locks and inactivity timers mandatory (Konfirmity, updated 9 Oct 2026). Linford's example timeout is 10 to 15 minutes. No criterion sets a number, so choose one, write it into the endpoint policy and keep proof that it is enforced. Without MDM, the no-MDM checklist shows the dated screenshots or reports that work as evidence.

Remote-specific risks and incident response

Konfirmity names insecure home routers, shared devices and eavesdropping in public spaces as risks that remote work adds, and notes that responders spread across time zones make coordination slower, so plans should name backup responders and schedule drills when people in different regions can attend (Konfirmity). Put these in your risk assessment. Its page also quotes many third-party breach statistics; none are repeated here because they are not SOC 2 facts.

The evidence to keep

• The signed remote work policy and home-office confirmation for each person
• A device inventory that matches the HR roster, with encryption and screen-lock state per device
• Training completion, via the training page
• Each quarterly or periodic access review
• The annual review of each cloud provider's SOC 2 report

Run the mock audit to see which of these you can produce today.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.