From f919c3ddc6864a03afac9625d2deddc4090f0155 Mon Sep 17 00:00:00 2001
From: gearnode <bryan@frimin.fr>
Date: Mon, 13 Jan 2025 10:19:05 +0100
Subject: [PATCH] Add real estate control

Signed-off-by: Bryan Frimin <bryan@frimin.fr>
---
 ....001_cloud_datacenter_physical_security.md | 28 ++++++++++++++++
 .../PHY.REA.002_physical_access_control.md    | 33 +++++++++++++++++++
 .../PHY.REA.003_visitor_access_policy.md      | 22 +++++++++++++
 3 files changed, 83 insertions(+)
 create mode 100644 controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md
 create mode 100644 controls/physical/real-estate/PHY.REA.002_physical_access_control.md
 create mode 100644 controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md

diff --git a/controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md b/controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md
new file mode 100644
index 000000000..547e5249f
--- /dev/null
+++ b/controls/physical/real-estate/PHY.REA.001_cloud_datacenter_physical_security.md
@@ -0,0 +1,28 @@
+---
+id: "PHY-REA-001"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "15m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+You know how critical a data center is. You don’t want unauthorized
+people to access it.
+
+## Implementation
+
+### Google Cloud Platform
+
+Nothing, it is already done
+
+> Evidence to provide: https://cloud.google.com/trust-center?hl=en
+
+
+## Evidence
+
+- Security document of your datacenter.
diff --git a/controls/physical/real-estate/PHY.REA.002_physical_access_control.md b/controls/physical/real-estate/PHY.REA.002_physical_access_control.md
new file mode 100644
index 000000000..7d2557e1d
--- /dev/null
+++ b/controls/physical/real-estate/PHY.REA.002_physical_access_control.md
@@ -0,0 +1,33 @@
+---
+id: "PHY-REA-002"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+Even if you do most of your business online, you still have offices,
+computers or even printed document: you need to make sure those assets
+are physically secured (we will focus on the digital access later).
+
+## Implementation
+
+If you are working from a coworking space or subleasing offices, you
+don’t have much do to. Provide a link to their access policy and the
+dashboard they probably provide to manage the list of authorized
+personnel.
+
+If you have your own office space, you need to provide:
+- The security system/measure you implemented (badge, pin, etc…) -
+  select the right element in the evidence section.
+- The dashboard where you track authorized personnel.
+
+## Evidence
+
+- Access policy document from your coworking provider.
+- Screenshot of the dashboard with a list of authorized personnel.
diff --git a/controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md b/controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md
new file mode 100644
index 000000000..97f9257c4
--- /dev/null
+++ b/controls/physical/real-estate/PHY.REA.003_visitor_access_policy.md
@@ -0,0 +1,22 @@
+---
+id: "PHY-REA-003"
+category: "physical/real-estate"
+revision-version: 1
+revision-date: "2024-01-13"
+estimate-time: "15m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC6.4"]
+---
+
+## Purpose
+
+Even if you do most of your business online, you still have offices,
+computers or even printed document: you need to make sure those assets
+are physically secured (we will focus on the digital access later)
+regarding visitors.
+
+## Implementation
+
+Visitors must be accompanied by an employee at all times when they are
+on premises.