SOC 2 for fully remote companies: offices, devices and cloud

No office is required, but you still need a physical access control answer. CC6.4 asks the organization to limit physical access to facilities and protected information assets, such as data center facilities and backup media storage, to authorized people. A fully remote company usually meets this by relying on its cloud provider for data center controls and by documenting how it protects company laptops, home offices used for sensitive work, and any storage media that leaves a device. Your auditor will want to see that you considered every location where protected information sits, including employee homes and any coworking space. Confirm the exact boundary with your auditor before the examination starts, because the answer depends on where your data and devices actually are.

Carve-out reporting means your report excludes the cloud provider's own controls, and the provider's SOC report covers them instead. Most remote companies run on a cloud platform, so physical and environmental controls at the data center are usually carved out. Under the AWS shared responsibility model, physical and environmental controls are fully inherited by the customer, while patch management, configuration management and awareness and training are shared, and zone security remains your responsibility. Your system description must name the provider, identify the controls you rely on, and list them as complementary subservice organization controls. You then need to collect the provider's current SOC report and review its exceptions and complementary user entity controls. Ask your auditor which approach fits your system, since inclusive and carve-out reporting produce different evidence requests.

A device management tool can produce much of the evidence, but it does not satisfy the criteria by itself. Tools in this category collect data such as enrolled devices, user accounts, device health, installed software and security settings. Fleet, for example, collects this data from macOS, Linux, Windows, ChromeOS, iOS and Android devices, and its documentation describes this device-level visibility. That data supports CC6.8 points of focus on restricting software installation, detecting unauthorized changes and running antivirus or anti-malware, and it supports CC6.7 points of focus on protecting endpoints and removable media. The auditor still needs your policy, your defined exceptions process and proof that someone reviews the results. Confirm with your auditor which exports and time-stamped records they will accept, and whether they expect a point-in-time snapshot or a history over the observation period.

Disposal starts with a written standard that matches the sensitivity of the data each device held. CC6.5 expects you to keep logical and physical protections on assets until the data and software on them can no longer be read or recovered and are no longer needed. NIST SP 800-88 Rev. 2, published in September 2025, helps organizations build a media sanitization program with techniques matched to information sensitivity, and it supersedes Rev. 1 from 2014. In practice, remote teams often use a documented wipe or cryptographic erase for laptops, a certificate of destruction for drives that cannot be sanitized, and a ticket that links each device serial number to the method used. Ask your auditor which disposal records they will sample, and confirm whether a third-party disposal vendor's certificates are acceptable evidence in your case.

Your company supplies the controls, the records and the system description, and an independent CPA firm tests them. The organization owns its controls. For devices and cloud, that means a current device inventory, an access and endpoint policy, a removable media rule, a disposal log, the list of cloud providers and their SOC reports, and the evidence that reviews actually happen. An implementation partner can help set up device management, prepare the evidence and document the controls, but only the independent auditor issues the report. Many remote teams can do the groundwork themselves if one person owns the device inventory and calendars the reviews. Consider outside help when no one has time to run the controls every week, when the scope spans several cloud accounts, or when the first examination exposes gaps that need engineering work. Ask any provider to state in writing which deliverables they prepare and which belong to your auditor.

Keep device records for at least the full observation period, and retain them through the audit and any follow-up sampling. A Type 2 report tests operating effectiveness over a period, so the auditor selects samples across that window and needs records dated within it. Device inventories, MDM exports, access reviews, exception tickets and disposal certificates should be retained in a way that proves when each record was created. Your retention policy should state the minimum period and the storage location, and it should cover records for devices that were retired during the period. The auditor will confirm the required period during planning, so ask them to put that answer in writing before you set your retention schedule.

Cost depends on how many devices, cloud accounts and locations are in scope, and on how much of the control work already exists. The main components are the independent CPA examination fee, the tooling for device management and logging, staff time to run the controls, and any outside help for setup or evidence preparation. Tooling costs usually recur, while policy writing, device setup and the first system description are largely one-time. Costs rise with the number of operating systems, contractor devices, and cloud accounts, and they fall when one device platform and one cloud provider are used consistently. The published cost ranges you may see online vary widely, so ask any provider for a written, fixed-scope quote that lists each device, account and deliverable in scope.