Add real estate control

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md

@@ -0,0 +1,28 @@
+---
+id: "PHY-REA-001"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "15m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+You know how critical a data center is. You don’t want unauthorized
+people to access it.
+
+## Implementation
+
+### Google Cloud Platform
+
+Nothing, it is already done
+
+> Evidence to provide: https://cloud.google.com/trust-center?hl=en
+
+
+## Evidence
+
+- Security document of your datacenter.

controls/physical/real-estate/PHY.REA.002_physical_access_control.md

@@ -0,0 +1,33 @@
+---
+id: "PHY-REA-002"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+Even if you do most of your business online, you still have offices,
+computers or even printed document: you need to make sure those assets
+are physically secured (we will focus on the digital access later).
+
+## Implementation
+
+If you are working from a coworking space or subleasing offices, you
+don’t have much do to. Provide a link to their access policy and the
+dashboard they probably provide to manage the list of authorized
+personnel.
+
+If you have your own office space, you need to provide:
+- The security system/measure you implemented (badge, pin, etc…) -
+  select the right element in the evidence section.
+- The dashboard where you track authorized personnel.
+
+## Evidence
+
+- Access policy document from your coworking provider.
+- Screenshot of the dashboard with a list of authorized personnel.

controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md

@@ -0,0 +1,22 @@
+---
+id: "PHY-REA-003"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "15m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+Even if you do most of your business online, you still have offices,
+computers or even printed document: you need to make sure those assets
+are physically secured (we will focus on the digital access later)
+regarding visitors.
+
+## Implementation
+
+Visitors must be accompanied by an employee at all times when they are
+on premises.