Data center security standards: what SOC 2, ISO 27001 and PCI DSS ask of video
Data center security standards ask three things of video in different words: watch the entrances to sensitive areas, prove that physical access matched authorization, and keep the record long enough to audit. Spot AI's AI Security Guard produces that evidence on the cameras a data center already has, but no video platform makes a facility compliant: auditors judge the operator's controls, and video is one of them. Of the three frameworks in this guide, only PCI DSS v4.0.1 sets a retention period for footage, and federal guidance in NIST SP 800-53 leaves video review and retention periods for each organization to define (Source: NIST).
Key takeaways
- SOC 2, ISO/IEC 27001:2022 and PCI DSS v4.0.1 all expect controlled, monitored entry to sensitive areas and evidence that access matched authorization.
- Only PCI DSS v4.0.1 names a retention period for physical access video: at least three months, unless law restricts it. SOC 2 and ISO/IEC 27001 set none.
- Spot AI supplies evidence that supports an audit, not compliance itself: clips paired with badge events, tailgating detections, camera-offline alerts and case files with time-stamped logs.
- Spot AI keeps full-resolution video in the facility on its IVR and controls who sees footage with role-based permissions per camera and single sign-on, which is what auditors check about the video system.
- In colocation, the provider's report usually covers the building and the tenant's controls cover the cage, and Spot AI runs on whichever side owns the cameras.
Which standards apply to a data center's video
Spot AI's evidence is tested against three frameworks in a data center, and scope decides which of them an auditor applies:
- SOC 2. A service organization reporting on its controls to customers. Physical access sits in the Security common criteria, which every SOC 2 report includes (Source: AICPA).
- ISO/IEC 27001:2022. A certifiable information security management system. Annex A groups 14 physical controls under theme 7, and the Statement of Applicability says which ones the site uses (Source: ISO).
- PCI DSS v4.0.1. Any facility housing systems that store, process or transmit cardholder data. Requirement 9 applies to the cardholder data environment (CDE) and to the sensitive areas inside it (Source: PCI Security Standards Council).
These are the data center's own controls. The video platform's controls, its SOC 2 report, single sign-on and retention settings, are a separate review that the SOC 2 checklist for video platforms walks through.
The control-by-control map
Spot AI's evidence maps to specific clauses, and the table below quotes or paraphrases each one from the version current in October 2026. "Not stated" means the standard sets no retention period for footage:
Framework and version | Clause | What it asks | What Spot AI's video evidence covers | Retention it states |
|---|---|---|---|---|
SOC 2, 2017 Trust Services Criteria (revised points of focus, 2022) | CC6.4 | Restrict physical access to facilities and protected information assets "(for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel". Points of focus include removing and reviewing physical access and recovering badges | Spot AI pairs clips of entries at controlled doors with badge events, for the access reviews an auditor samples | Not stated |
SOC 2, same version | CC7.2 | Monitor system components for anomalies indicating malicious acts. A point of focus names detection of "compromise of physical barriers" | Spot AI detects fence breaches, forced or held doors and after-hours presence, with time-stamped logs | Not stated |
ISO/IEC 27001:2022, with Amd 1:2024 | Annex A 7.1 and 7.2 | Define security perimeters, and protect secure areas with appropriate entry controls and access points | Spot AI corroborates entry controls with video at the perimeter and each access point | Not stated |
ISO/IEC 27001:2022, with Amd 1:2024 | Annex A 7.4 | Monitor premises continuously for unauthorized physical access | Spot AI runs always-on detection at the perimeter, entries and restricted zones, with alerts | Not stated. ISO/IEC 27002:2022 guidance points recorded-video retention to local law |
PCI DSS v4.0.1 | 9.2.1.1 | "Individual physical access to sensitive areas within the CDE is monitored with either video cameras or physical access control mechanisms (or both)": entry and exit points monitored, devices protected from tampering or disabling, data reviewed and correlated with other entries | Spot AI watches each sensitive-area door, alerts when a camera goes offline, and opens the clip for each badge record | At least three months, unless otherwise restricted by law |
PCI DSS v4.0.1 | 9.3.1.1, 9.3.2, 9.3.4 | Access by job function, revoked immediately on termination; visitors authorized, escorted and badged; a visitor log | Spot AI clips show whether visitors were escorted and back each sampled entry | Visitor log: at least three months |
NIST SP 800-53 Rev. 5, release 5.2.0 | PE-6 and PE-6(3) | Monitor physical access to detect and respond to incidents; the video enhancement adds reviewing and retaining recordings | The same Spot AI evidence serves programs that map to NIST controls | Organization-defined |
One clip of one person passing on one badge at a sensitive-area door answers CC6.4, Annex A 7.2 and PCI DSS 9.2.1.1 at once, so one evidence process serves a multi-framework audit.
Retention: what the standards say, and what they leave to you
Spot AI keeps footage on the IVR for a window each site sets and sizes, so the number has to come from the strictest standard in scope rather than from a platform default. PCI DSS v4.0.1 is the only framework here that names one: at least three months for video or access control data covering sensitive areas (9.2.1.1), and three months for the visitor log (9.3.4). SOC 2 sets no period, but a Type 2 report tests controls across an examination period, so the clip behind a sampled event has to exist when the auditor asks. ISO/IEC 27001 sets none for footage.
Set the window in this order:
- Start from the strictest named minimum. Three months for every camera covering a sensitive area inside a PCI DSS scope.
- Cover the audit period. Keep, or preserve into a case, anything an auditor could sample from the current examination period.
- Add holds. Open incidents, investigations and litigation holds override the rolling window until released in writing.
- Prove it per camera. Check each camera's actual retention at its real resolution.
The video retention and chain-of-custody guide covers holds, custody and disposal.
Key terms
- Sensitive area. In PCI DSS, typically a subset of the CDE housing systems critical to it, which includes data centers and server rooms.
- Carve-out method. A SOC 2 report that excludes a subservice organization's controls, such as a colocation provider's physical security, from its scope.
Access review evidence an auditor can sample
Spot AI turns an access review from a log export into a sample an auditor can watch: pick badge events, open each clip, and confirm the person at the door matched the credential. Spot AI lists integrations with access control platforms such as Brivo, Kisi and ProdataKey on its integrations page and uses access events to find the matching clips. A workable review runs like this:
- Pull the population. Export entries to sensitive areas for the period, the termination list and the visitor log from the access control system.
- Open the clip for each event. Check one person per credential, a closed door afterwards, and an escort beside every visitor.
- Check terminations in the log. PCI DSS 9.3.1.1 and SOC 2 CC6.4 both expect access removed on departure.
- Show the monitoring itself held. Pull the camera-offline alert history for the period, because PCI DSS 9.2.1.1 expects monitoring devices protected from tampering or disabling.
- File exceptions as cases. A tailgating detection or an unexplained gap goes into a case with its clip, its owner and its resolution.
For how teams run detection, deterrence and documentation on cameras they already own, Spot AI's white paper Turning Cameras Into Coworkers collects results from field deployments in retail, convenience stores and EV charging networks.
Sync the camera clocks to the same time source as the access control system before the audit period starts. PCI DSS 9.2.1.1 expects video to be correlated with other entries, and a two-minute drift turns every pairing into an argument.
Exports an auditor will accept
Spot AI files clips with their timestamps into cases that carry a time-stamped log and can be shared with an auditor, and a person assembles those cases into the audit evidence; nothing is generated automatically. Each item needs the camera and door, the original timestamp, the matching access record, and who exported it. Cases hold preserved clips after the rolling window moves on.
Footage of a sensitive area is sensitive too, so the video system gets its own review. Spot AI's published security controls include role-based access set per camera and per feature, single sign-on through SAML, SCIM provisioning with Azure AD and Okta, AES-128 encryption at rest and TLS 1.2 in transit, and SOC 2 Type II, while full-resolution video stays in the facility and only metadata crosses the network.
The YMCA of Greater Richmond shows the administrative side of that: it rolled Spot AI out across 17 locations in two weeks, standardized 30-day retention across every site, connected single sign-on to its Active Directory, and kept critical footage in Cases.
"Spot AI has saved our risk management officer a tremendous amount of time, and increased our efficiency in incident reporting."
Louie Klenke, Technology Project Lead and Systems Specialist, YMCA of Greater Richmond
Shared responsibility in colocation
Spot AI can run on the provider's cameras or the tenant's, so in a colocation facility the first task is to write down which side owns which layer. The split below is the usual one, and the contract has the final word:
Layer | Usually controlled by | Evidence the tenant collects |
|---|---|---|
Perimeter, gates, lobby and mantrap | Provider | The provider's current SOC 2 Type 2 report or ISO/IEC 27001 certificate covering physical controls |
Data hall aisles and shared cameras | Provider | A written procedure and turnaround time for footage requests |
Cage or private suite | Tenant, within provider rules | The tenant's access list, badge records and, where cameras are permitted, Spot AI clips of the cage door |
Racks and media | Tenant | Rack lock records and media logs |
Two mechanisms make the split auditable. A tenant's own SOC 2 report usually carves the provider out, so the tenant reviews the provider's report and operates the complementary user entity controls that report lists, such as keeping its access list current and telling the provider when someone leaves. PCI DSS v4.0.1 requirement 12.8.5 asks the tenant to maintain information on which requirements each service provider manages, which the tenant manages, and which are shared. Physical security of the cage often lands in the shared column.
A pre-audit checklist for data center video
Spot AI recommends working through this list in the month before fieldwork; copy it and give each line an owner:
- List every framework in scope and the clauses from the map above.
- Mark every sensitive-area door and confirm a camera covers each entry and exit.
- Confirm camera clocks and the access control system agree to the second.
- Verify each camera's actual retention meets the strictest window in scope.
- Export the camera-offline alert history for the period, with a reason for each gap.
- Run a trial sample of badge events and open the clip for each one.
- Check that leavers lost access on their last day, and that the visitor log is complete and held three months for PCI DSS.
- Export tailgating detections for the period, with how each was resolved.
- Review who can view and export footage, and remove leavers.
- In colocation, file the provider's current report and map the user entity controls it assigns to you.
Run the trial sample a month before fieldwork, not the week of it. A drifted clock or a short retention window found early is a fix; found by the auditor, it is an exception.
Spot AI's AI Security Guard gives a data center the evidence these standards test, on the cameras already installed, while the operator keeps ownership of the controls and the audit. Camera placement layer by layer is in the data center physical security guide, and the wider sector picture in what critical infrastructure physical security covers. To see how Spot AI approaches audit evidence across sites, start with the product overview.
Frequently asked questions
Does SOC 2 require security cameras in a data center
Spot AI's video evidence supports SOC 2, but SOC 2 does not require cameras. Criterion CC6.4 asks the entity to restrict physical access to facilities such as data centers to authorized personnel, and CC7.2 asks for detection of anomalies, including compromised physical barriers. Video is one common way to evidence both.
How long must data center video be kept for PCI DSS
Spot AI sites inside a PCI DSS scope should keep sensitive-area video for at least three months. PCI DSS v4.0.1 requirement 9.2.1.1 says data collected from video cameras or physical access control mechanisms is stored for at least three months, unless otherwise restricted by law.
Does ISO 27001 require video monitoring
Spot AI's always-on detection maps to ISO/IEC 27001:2022 Annex A control 7.4, which asks for premises to be continuously monitored for unauthorized physical access. The standard does not mandate cameras or a retention period: guards, alarms or video can meet it, and ISO/IEC 27002 points retention to local law.
How long should data center video be kept for a SOC 2 audit
Spot AI sites set their own retention window, because SOC 2 names no period for footage. A Type 2 report tests controls across an examination period, so keep, or preserve into a case, any clip an auditor could sample from that period. Where PCI DSS is also in scope, its minimum of three months for sensitive-area video applies.
Who is responsible for video in a colocation data center
Spot AI fits on either side, so the contract decides. The provider usually controls perimeter, lobby and hall cameras, and the tenant controls its cage. Write the split down: PCI DSS expects a record of which requirements sit with the provider, the tenant or both (12.8.5), and a provider's SOC 2 report lists the controls the tenant must run.
About the author
Amrish Kapoor, VP of Engineering
Amrish Kapoor is VP of Engineering at Spot AI, leading platform and product engineering teams that build the scalable edge-cloud and AI infrastructure behind Spot AI's video AI, powering operations, safety, and security use cases.
