18 Physical & Environmental Security in HITRUST CSF

What HITRUST domain 18 Physical & Environmental Security asks for

If a HITRUST assessment is on your calendar, assessors will expect you to show that every facility hosting in-scope systems is controlled, both for who can physically enter it and for whether the building keeps running. Domain 18, Physical & Environmental Security, is the part of the assessment that covers those questions. It is one of the 19 assessment domains HITRUST uses to group requirement statements and score certification in the e1, i1 and r2 reports. In plain terms, it asks whether people without a need to be in a server room, data hall or network closet are kept out, whether the people who do enter are identified and recorded, and whether power, cooling and fire protection are designed and maintained so that equipment is not lost to a physical or environmental event.

The risks behind the domain are simple to state. Unauthorized physical access can lead to theft of media, tampering with hardware, or a direct connection to the network that bypasses logical controls. Facility failure, such as a loss of power, cooling or fire suppression, can take availability down just as surely as an attack. An assessor will typically look at how entry is granted and removed, how visitors are escorted, how access logs and camera footage are kept, and how power, HVAC, fire detection and water sensors are monitored and tested. Confirm with your assessor which facilities, including colocation cages, offices that house administrators and disaster recovery sites, fall inside the assessed scope before you gather evidence.

This is often the easiest domain to inherit. When a cloud provider fully manages data center security, biometrics, HVAC and redundant power, an organization can usually reuse that provider's assessed results instead of testing the same controls itself. HITRUST uses this exact example in its guidance on inheritance. The picture changes for on-premises rooms and colocation spaces, where the organization owns the physical controls, must produce its own logs and must show that its colocation provider's controls are documented and reviewed. Ask your provider for its current HITRUST or SOC 2 report and check the inheritance terms against your own scope, since the HITRUST Assessment Handbook sets out the rules for how assessors may rely on that evidence.

Which facilities, equipment and providers fall in scope for this domain

Physical and environmental controls only apply to the places where in-scope data and equipment actually sit. The facility model you run, the assessment level you pursue and whether a provider's data center can be inherited together decide how much of this domain you must test yourself.

Owned data centers

If you operate your own data center, every access point, camera, badge reader, visitor log and environmental system that protects in-scope servers is part of the assessed work. You will need to show who can enter, how entry is revoked and how power, cooling and fire suppression are monitored. Confirm early whether the room housing a single rack is assessed as a facility or as an area within a building.

Colocation facilities

In colocation, the data center operator owns the building, but you still own your cage, racks and the access you grant your staff and contractors. Ask the operator for its own independent report that covers physical and environmental controls, then confirm which of those controls your cage-level access depends on. The gap between the operator's scope and your scope is where most findings tend to appear.

Cloud data centers

When in-scope workloads run in a cloud provider's facilities, the provider typically manages data center security, biometrics, HVAC and redundant power. You inherit those controls only where the provider's HITRUST results or a shared responsibility matrix cover the specific regions and services you use. Verify that the facilities named in the provider's documentation match the regions where your data is stored.

Offices and server rooms

Offices, network closets and small server rooms often hold in-scope equipment that teams overlook, such as switches, backup appliances or a printer with stored scans. Each location that holds in-scope equipment needs controlled entry, equipment placement and environmental protection. Build a room-by-room inventory before scoping so that no closet is left out of the assessed boundary.

Remote and home workspaces

Staff working from home do not bring a facility into scope, but their home workspace can hold laptops, paper records or tokens that reach the in-scope environment. Decide whether your policy restricts where devices may be used, how screens are protected from view and how equipment is returned or wiped. Document that decision explicitly, since assessors will look for it in the domain.

Assessment level and r2 scope

The e1, i1 and r2 differ in how many requirement statements apply, so the physical controls tested depend on the level you pursue. An r2 scope can also be tailored, which may remove or add facilities. Confirm with your assessor which level applies and which facilities fall inside the boundary before you commit to a fieldwork plan.

How an assessor tests physical and environmental controls

This table compares the assessor's test activities for Domain 18 with the evidence each one requests and the findings that usually follow. Read each row as a test the assessor will run during fieldwork, then check whether your own records would pass it. The main takeaway is that facility controls are tested on records and walkthroughs, so the evidence must exist and be current before fieldwork starts.

Test activity	What the assessor examines	Evidence requested	Common finding
Document review	Facility security policies, physical access procedures, visitor handling and environmental maintenance procedures	Approved policies with owners and review dates, procedure documents, role assignments	Procedures exist but do not match how staff actually grant or remove access
Walkthrough of entry points	Badge readers, mantraps, locked doors, reception, loading areas and server room entry in scope	Observed controls, facility diagrams marking in-scope areas, photos or notes from the walkthrough	Doors propped open or secondary entry points not included in the access model
Visitor handling	Sign-in, escort requirements, badge issuance and return for visitors to restricted areas	Visitor logs with times, escorts and badge return entries for the sample period	Expired or incomplete visitor logs with no escort or return recorded
Access list review	Who holds access to data centers, server rooms and network cabinets, and whether the list is reviewed	Current access lists, dated review records, approvals and removal tickets for leavers	Access lists not reviewed on a defined cycle or still listing former staff
Badge and access log sampling	A sample of entries and exits in restricted areas, checked against authorization	Badge system logs, exception reports and the sampled individuals' authorization records	Logs not retained for the period sampled or unexplained access events not investigated
Environmental monitoring review	Power, cooling and environmental alarms for in-scope facilities and their response	Monitoring dashboards or alert history, alarm escalation records, incident tickets	Alerts generated but no evidence of who responded or how
Maintenance record inspection	Scheduled servicing of HVAC, fire suppression, uninterruptible power and generators	Maintenance schedules, service reports and corrective work orders with dates	Maintenance logged as planned but not performed on the stated cycle
Unmonitored server room check	Whether server rooms and equipment closets are covered by cameras, alarms or periodic checks	Camera coverage maps, alarm configuration, periodic inspection logs	Server rooms without cameras or alarms and no compensating check recorded
Inherited provider report review	Which facility controls a cloud or colocation provider performs and how the organization relies on them	Provider assurance reports, responsibility matrix, the organization's review of those reports	Reliance claimed without reviewing the provider report or confirming its scope covers the facility used

Implementing physical and environmental controls step by step

This sequence takes an organization from an undefined physical footprint to a documented, tested and evidenced set of facility controls for the 18 Physical & Environmental Security domain, with each step producing material an assessor can sample.

Define the physical scope of the assessment
Start by listing every facility, data hall, office, rack room and remote site that houses in-scope systems, storage or staff with access to them. Record the business owner for each location and whether it is operated by you, a colocation provider or a cloud provider. The owner of this step is usually the CISO or compliance lead, working with facilities and IT. It is done when the scope statement names each location, its operator and the systems it supports, and the scope has been approved in writing and matches the boundary used for the rest of the assessment.
Map locations to providers and inheritable controls
For each location in scope, identify who controls physical access, power, cooling and fire protection. Where a cloud provider or colocation operator manages the data center, request its current independent assurance reports and its description of physical controls, then note which requirement statements can be inherited and which remain your responsibility, such as visitor logs for your own office or badge issuance for your staff. The output is a responsibility matrix per location. Confirm with each provider exactly what its reports cover, since a report that excludes a site or a service leaves a gap you must fill yourself.
Document access and visitor procedures
Write the procedures that govern how people enter, move within and leave each in-scope location. Cover employee and contractor access requests, approval by a named owner, escort rules for visitors, sign-in and sign-out logs, and what happens to access cards when someone leaves. Keep the procedures short enough that staff follow them, and assign an owner and review date to each. The step is complete when each procedure is approved, published to the people who use it, and linked to the location it governs, since an assessor will check both the written rule and whether staff follow it.
Configure badge and camera records
Set up the badge system so that every card maps to a named person, a defined set of doors and an approval record. Confirm that camera coverage reaches entry points, server rooms and equipment cabinets, and that retention settings for footage and access logs are written down and enforced in the system. Test the configuration by requesting a sample badge, revoking it and confirming the change in the access log. The evidence is a configuration export, a sample of access records and a screenshot or report showing camera retention settings, dated and kept with the scope statement.
Set up environmental monitoring and maintenance schedules
Identify the power, cooling, humidity, water and fire detection systems that support in-scope equipment, and configure alerts that reach a staffed team outside business hours. Create a maintenance calendar for uninterruptible power supplies, generators, HVAC units and fire suppression, and assign a responsible party for each item. Record each inspection, service visit and alert response. This step produces a monitoring configuration, the maintenance calendar and the first set of completed service records, which together show that environmental risks are watched and that maintenance happens as planned.
Run and record a physical access review
Pull the list of everyone with active access to each in-scope location, along with their business justification, and compare it against current HR and contractor records. Ask the approving owner to confirm each entry, remove access that is no longer needed, and log the removals. Repeat the review at the frequency your own procedure sets. The review is finished when every exception has a documented decision and the reviewer has signed the list. This is one of the records assessors most often sample, so keep the signed review, the source data and the change log together.
Capture evidence and prepare for sampling
Collect the output of each earlier step in one evidence folder for each location: the scope statement, responsibility matrix, procedures, badge and camera configuration, monitoring records, maintenance logs and access reviews. Date every item, record who produced it and retain the source exports rather than only summaries. Check that the evidence covers the period the assessment will test, and that inherited items carry the provider reports that support them. The finished folder lets an independent assessor sample records without relying on verbal explanations, and it shows where a control has gaps that need corrective action before fieldwork begins.

Which evidence passes a physical and environmental security test

Assessors test domain 18 by sampling records that show who can enter facilities, how that access is reviewed, and whether power, cooling and fire protection are maintained. The cards below cover the artifacts most often requested and how to keep each one current between assessments. Where a provider runs the facility, the organization still needs evidence of how that inheritance was documented and checked.

Facility access policy and owners

The written policy defines who may request physical access to each in-scope facility, who approves it, and how access is revoked. Assessors look for a named owner for each site and a review date. Check that the policy names the data centers, server rooms and network closets actually in scope, not only a generic office. Review it on a fixed cadence, such as annually, and after any move, reorganization or change of provider. Record each review with a version number and approver so the history is provable.

Access lists and periodic reviews

Access lists show which individuals and contractors hold physical credentials for each in-scope area. Assessors compare the list against HR and contractor records to find leavers and expired badges still active. Export the list from the badge system, reconcile it against the joiner, mover and leaver process, and have the site owner sign the result. Run the review at a set interval and keep the signed copies. A review with no removals found is still evidence, provided the reviewer shows what was compared.

Badge and visitor logs

Badge logs and visitor sign-in records show who entered, when, and under whose escort. Assessors sample dates across the assessment period and check that entries match approved access. Confirm that visitor records capture name, organization, host and time out, and that logs are protected from edit. Ask the badge or visitor system owner how logs are exported and who can alter them. Gaps across sampled dates are a common reason for a corrective action, so verify coverage before fieldwork starts.

Camera footage and retention settings

Camera coverage of entry points, server areas and equipment racks is usually expected, along with a stated retention period. Assessors check the retention configuration on the recording system and sample footage to confirm it exists for the stated window. Document where cameras are placed, who can view live and recorded footage, and how access to recordings is logged. Set the retention value in the policy to match what the system actually does, and check it after every system upgrade.

Power, HVAC and fire alarm records

Maintenance and test records show that uninterruptible power, generators, cooling and fire suppression work as designed. Assessors ask for service contracts, inspection reports and test logs, including the dates of the most recent tests and any open defects. Confirm that each record names the asset and the technician, and that deficiencies have tracked remediation. Schedule these checks with the facilities team and keep them in the same register as the access reviews so none is missed at assessment time.

Provider inheritance documentation

Where a cloud provider or colocation operator runs the data center, the organization can often reuse that provider's physical controls. HITRUST's inheritance example notes that a provider can fully manage data center security, biometrics, HVAC and redundant power, which makes this domain highly inheritable. The organization still needs the provider's assessment report, a shared responsibility matrix showing which controls are inherited, and a record of how the provider's scope covers the facilities in use. Confirm the provider's report is current and covers the regions and sites you use.

What meeting physical and environmental security costs

This table breaks the cost of the 18 Physical & Environmental Security domain into components, showing who is paid, whether each item is one-time or recurring, and what moves it up or down. No figures are supplied for this domain, so use the rows to build the questions you put to a quote. The main takeaway is that inherited facilities often remove the largest cost lines, leaving your own evidence and review effort.

Cost component	Who is paid or who spends	One-time or recurring	What drives it up or down
Facility access systems and monitoring licenses	Your organization or its vendor, for badge readers, cameras, visitor logs and monitoring software	Mostly one-time setup, with recurring license and support fees	Number of sites in scope, whether systems are shared with other facilities, and whether a colocation provider already runs them
Facility staff time for reviews and maintenance	Your internal facilities, security and operations staff	Recurring	Frequency of access reviews, number of visitors and contractors, and how much review is manual rather than system-generated
Evidence upkeep	Your compliance and IT staff, and any implementation partner you engage to organize records	Recurring	Volume of access logs, environmental alarm records and maintenance tickets to retain, and how well they are indexed for sampling
External readiness review	An independent readiness consultant or implementation partner, under a written scope	One-time per assessment cycle, with follow-up reviews as needed	Number of facilities, depth of gap testing, and whether you need a pre-assessment review of provider inheritance documents
Assessor fieldwork effort	The Authorized HITRUST External Assessor you engage, billed under its own engagement terms	Recurring with each validated assessment	Fieldwork is limited to a window of at most 90 days, so scope, site count and sample sizes set the effort
Inherited provider controls	Your cloud or colocation provider, which carries the physical control work	Recurring through your contract and any reliance on their reports	Whether the provider can supply evidence for inherited requirements, and how much you must still test yourself

Who owns, who prepares and who attests physical controls

The organization that holds the certification owns its physical and environmental controls, including every decision about who may enter a facility, which data halls or equipment rooms are in scope, and which providers are trusted to host in-scope systems. Ownership does not disappear when a cloud provider runs the data center. It moves into a set of questions the organization must answer: what the provider's controls cover, what the organization still operates itself (badges for its own offices, racks it manages in colocation space, visitor handling at its sites), and who approves exceptions. HITRUST's own inheritance example describes a provider that fully manages data center security, biometrics, HVAC and redundant power, which is why this domain is often inheritable. Inheritance still requires the organization to document the boundary.

Scope decisions: Name each facility, data hall, office and rack that holds in-scope data or equipment.
Access authorization: Approve who receives physical access, how it is removed and who reviews it.
Provider boundary: Record which controls the cloud or colocation provider operates and which remain with the organization.
Exception approval: Decide, in writing, how temporary access such as contractor escorts is granted and recorded.
Accountable owner: Assign a named executive who signs off on the physical security position.

Confirm with your provider which HITRUST inheritance results and shared responsibility documents it can supply before you finalize your own boundary.

Where physical and environmental controls usually fall short

Domain 18 failures rarely come from missing locks or cooling. They come from records that drifted out of date, evidence that sits with a provider the organization never asked for it, and boundaries nobody wrote down. The cards below cover the gaps assessors meet most often in this domain and what to check before fieldwork begins.

Stale physical access lists

Badge and key holder lists for the facilities in scope often keep former staff, contractors and vendors long after they leave. An assessor will compare the list against HR and contractor records and ask who approved each entry. Check that every access grant has a named owner, an approval record and a removal date tied to the offboarding process. Run a reconciliation against current employment and contract records before the assessment window opens, and keep the reconciliation as evidence.

Unreviewed visitor logs

Visitor sign-in sheets and electronic visitor records are often collected but never reviewed by anyone. The domain expects evidence that visitors are escorted, that their access is logged and that someone reviews those logs on a set schedule. Ask who reviews the log, how often, and where a review is recorded. A log that nobody signs off on tends to fail, even when the entries themselves are complete.

Colocation evidence missing from the provider

When systems sit in a colocation facility, the organization often assumes the provider's controls cover its requirements, but the provider holds the evidence. Without it, the assessor has nothing to test. Request the provider's physical security reports, visitor procedures and environmental maintenance records early, and confirm in writing what the provider will supply and how quickly. Contract terms should specify which of these documents the provider will share for assessment purposes.

Environmental alarms without test records

Alarms for temperature, humidity, water leaks, fire suppression and power failure are frequently installed but not tested on a documented schedule. An assessor will ask for proof that alarms trigger, that alerts reach a responsible person and that failures were investigated. Keep test logs with dates, results and corrective actions, and confirm which tests the facility operator performs on the organization's behalf.

Unclear inheritance boundaries

Teams often claim a physical or environmental requirement is inherited from a cloud or data center provider without defining exactly which parts of the requirement the provider covers. Gaps appear where the organization still owns badge issuance, equipment disposal or local server rooms. Write a shared responsibility matrix that assigns each domain 18 requirement to the provider, the organization, or both. Confirm that the provider's own assurance report covers the facilities and services in scope before relying on it.

Equipment movement without records

Servers, network gear and storage leaving a facility for repair, relocation or disposal often move without a record that ties the asset to a person and a date. Assessors look for an equipment log, a chain of custody and evidence of secure disposal or sanitization. Ask how removals are authorized, who signs for them and where the disposal certificates are kept.

Questions buyers ask about domain 18 before hiring help

How much effort does physical and environmental security take in a HITRUST assessment?

Effort depends mainly on how many facilities are in scope and whether the organization runs its own space. A company that operates one office and uses a cloud provider for hosting carries a much smaller load than one that runs its own server rooms, network closets and disaster recovery site. The work splits into two parts: documenting how access to each facility is granted, reviewed and removed, and showing that power, cooling and fire protections are maintained and tested. Much of the effort is evidence collection, such as visitor logs, badge access reports, maintenance records and facility inspection results, gathered consistently across every site in scope. Ask your assessor early which facilities and equipment they expect to see, because scope decisions set the workload more than the control count does.

Can physical and environmental security be inherited from a cloud provider?

Often yes, for the facilities the provider runs. HITRUST's own inheritance example describes this domain as highly inheritable, because a cloud provider typically manages data center security, biometrics, HVAC and redundant power. The organization still owns the parts it controls: who gets badge access to its offices, how equipment leaving its premises is handled, and how visitors are escorted. Inheritance depends on the provider's own HITRUST results or assessment reports being current and covering the services you use. Confirm with the assessor which provider evidence they will accept, how the shared responsibility matrix divides the work, and whether any facility you operate falls outside the provider's scope.

What does the work need from the team?

The work needs a facilities owner, a security owner who understands access control, and an operations contact who can produce records on request. Each role has distinct tasks:

Facilities staff provide access lists, maintenance contracts, inspection reports and environmental alarm records.
Security staff define access rules, review badge and visitor logs, and handle exceptions such as lost cards or after-hours entry.
Engineering or IT staff confirm which systems sit in each room and that equipment disposal follows the required process.

If these roles are split across departments, agree on one person to coordinate evidence. Missing or inconsistent records are a common reason assessors need follow-up, so set up a shared evidence folder before fieldwork starts.

Can the team handle physical and environmental security in-house?

A capable facilities or security team can usually handle the controls for its own offices and small server rooms in-house. Outside help tends to add value in three places: mapping which facility controls belong to a provider and which belong to you, preparing the evidence set so it matches what an assessor will sample, and checking that records are complete before fieldwork. Independent assessment is different. Only an Authorized HITRUST External Assessor organization can perform a validated assessment submitted for certification, and HITRUST performs central quality assurance before issuing reports. An implementation partner can prepare systems and evidence, but it cannot issue the report. Decide early which parts you will own internally and which you will buy as a fixed-scope engagement with written deliverables.

How does domain 18 affect e1, i1 and r2 scoring?

Domain 18 is one of the 19 assessment domains HITRUST uses to group requirement statements and score results in e1, i1 and r2 reports. The scoring thresholds are the same for every domain, so a weak result here can hold back the whole certification. For the e1 and i1, core requirement statements in each domain must average at least 83. For the r2, each domain must average at least 62 across all its requirement statements. Because this domain is among the smaller shares of failing domains HITRUST named in its 2025 Trust Report, it is less often the cause of a failed assessment, but a gap in one facility can still lower a domain average. Confirm with your assessor how they will score each in-scope facility and whether any requirement is marked not applicable.

What should I confirm with the assessor before fieldwork?

Ask the assessor to confirm the facilities, data centers and equipment rooms in scope, and which of them are covered by a cloud or colocation provider's assessment. Also confirm which evidence they will sample, how far back logs must go, and how they treat not-applicable decisions for facility controls. Check the fieldwork window the assessor expects, since HITRUST's Assessment Handbook sets a maximum of 90 days for validated fieldwork. Finally, ask how they want site visits arranged and whether they need escorted access to any restricted area. Get these answers in writing before the assessment starts so the evidence set can be built against a fixed scope.

What drives the cost of this domain up or down?

The main cost drivers are the number of facilities in scope, whether you run your own data center or rely on a provider, and how much of your existing access and facility evidence is already recorded in a usable form. Costs fall into two groups: internal staff time for collecting records and running reviews, and external fees for readiness support or the assessment itself. Inheritance reduces the work where a provider's results can be relied on. Ask for any quote to split costs by facility and by role, to state what is one-time (scoping, evidence setup, policy documentation) and what recurs (access reviews, maintenance records, annual or interim assessment work), and to list which items depend on the provider's results. DeployOpen does not publish a price list, and a quote follows from a written scope.

What evidence will an assessor ask to see for facility access?

Assessors typically ask to see the rules that govern facility access, the records that show who was granted access and when, and the reviews that confirm access stayed appropriate. Expect requests for badge access lists, visitor sign-in records, escort logs for restricted areas, and approvals for removing equipment from premises. Records should show the date, the person, the approver and the reason for each change. Keep the review cycle consistent and documented, because a complete record for one quarter does not show that the control operates all year. Your assessor will confirm the exact sample sizes and periods they test.

How DeployOpen prepares physical and environmental evidence

DeployOpen's part starts with scope. Before any evidence is gathered, the client and DeployOpen agree in writing which facilities, data halls, server rooms, network closets, cabinets and equipment storage areas fall inside the assessed environment, and which are supplied by a third party such as a colocation or cloud provider. That boundary decides whether the client must produce its own physical access records and environmental test results, or whether it must collect a provider's inherited statements and reports instead. Where the client runs self-hosted open-source platforms in its own data center, DeployOpen maps each rack, cabinet and console to the systems it hosts so that access logs and visitor records can be tied to specific assets. Confirm early whether any facility is outsourced, since the assessor will ask for the provider's documentation for that site.

Within that scope, DeployOpen implements the procedures in the client's own environment and keeps them traceable. This typically covers the access request and approval workflow for badges and keys, escort rules for visitors and contractors, periodic access reviews, and the removal of access when staff leave. On the environmental side, it covers documented checks of power distribution, uninterruptible power and generator testing, cooling and humidity monitoring, and fire detection and suppression, with alert thresholds and named owners for each. DeployOpen configures and documents these checks, and the client remains responsible for running them, signing off on exceptions and retaining the records. Ask the client's facilities team who holds the keys to the physical access system before fieldwork begins, because unclear ownership is a common reason evidence has gaps.

The final step is readiness. DeployOpen prepares an evidence set for each control in the domain, pairing a written procedure with dated records such as access logs, review sign-offs, maintenance tickets and monitoring exports, and runs a walkthrough to confirm that a staff member can explain and demonstrate the process. Gaps found in that review are logged and assigned before the assessor arrives. DeployOpen does not issue reports, attestations or certifications. Only an Authorized HITRUST External Assessor performs the validated assessment and HITRUST performs quality assurance before a report is issued, so the evidence DeployOpen prepares is an input to that independent review, not a substitute for it. Clients can confirm the assessor's status through HITRUST's Find an External Assessor page before engaging anyone.

18 Physical & Environmental Security