A SOC 2 Type II auditor sits in your NOC and asks a simple question: prove a human walked the cold aisle on Sunday at 03:00.
The DCIM dashboard cannot answer it. The temperature graph shows a clean trace, but the trace was recorded by sensors. The auditor wants evidence that an operator was physically there, observed the airflow separation, and would have caught a containment breach the sensors missed for thirty minutes after the failure. That is the gap hot/cold aisle patrol logs are meant to close.
Most data-center operators run thermal patrols. Few structure the patrol so it produces SOC 2 CC6 and EN 50600 §6 evidence in the same export. Here is the pattern that does.
What CC6 actually wants
SOC 2 Trust Services Criteria CC6 (logical and physical access controls) and EN 50600 §6 (operational management) overlap on one point: physical inspection of data center floor space at defined frequencies, with audit-ready records.
CC6.4 specifically requires that physical access to facilities is restricted and monitored. Monitoring includes both automated controls (badge readers, cameras) and procedural controls (patrols). The auditor expects to see both.
EN 50600-3-1 §6.2 defines operational management of cooling systems and adds a recurring inspection requirement that DCIM telemetry alone does not satisfy. The reason is in the standard: thermal sensors capture the result of containment, not the integrity of the containment itself. A blanking panel removed during a maintenance window can leave a hot/cold aisle compromised for hours before a sensor pattern shows it.
Anatomy of an audit-ready hot/cold aisle patrol
Five elements together produce evidence that satisfies both frameworks:
- Defined route per cooling zone. Each aisle gets a checkpoint at the cold-side air return, the hot aisle exhaust path, and the containment seal. A patrol misses no aisle in a given shift.
- Required photo per checkpoint. The photo captures the blanking panel state and any open cabinet door. The photo is the evidence the sensor cannot produce.
- Two-factor checkpoint. NFC or QR scan for proximity, GPS to geofence the scan inside the floor footprint. Single-factor scans are gameable; two-factor raises the audit bar without making the round longer.
- Frequency of four times per 24-hour day. EN 50600 does not name a specific frequency, but Tier III/IV operators almost always converge on four. SOC 2 auditors accept four when the route is documented in the security policy.
- Exception protocol. When a patrol misses an aisle (locked cabinet, contractor working in the zone), the operator logs a structured reason code with photo. Skips become documented gaps, not silent ones.
The aggregate output is a per-quarter export with timestamp, GPS, scan ID, photo and operator identity for every patrol event. SOC 2 auditors accept it as direct CC6 evidence; EN 50600 auditors accept it as §6.2 operational record.
Where DCIM integration helps
DCIM platforms (Schneider EcoStruxure, Vertiv Trellis, Sunbird dcTrack) export sensor traces but do not capture human verification. Modern guard tour software exposes a webhook per scan event; piping those events into the DCIM gives the operator a single timeline that combines automated telemetry with human verification. The combination is what the auditor calls "complementary controls" — and what reduces the SOC 2 evidence package from a two-week scramble to a five-minute export.
What this looks like in production
A 200-cage colocation facility we worked with switched from paper hot-aisle logs to QR-scanned thermal patrols in Q1 2026. The first SOC 2 Type II audit after the switch produced the evidence package in 42 minutes instead of the two-week scramble that preceded it. EN 50600 §6.2 inspection records, previously a separate workstream, came out of the same export. The auditor accepted both without follow-up questions.
The trade-off is up-front: 4 to 8 weeks for a 200-cage deployment, including QR placement and operator training. Once it is running, the audit cost falls to a download.
Further reading
- /sector/data-centers — sector page with EN 50600 + SOC 2 evidence patterns.
- /glossary/proof-of-presence — multi-signal verification definition.
- /glossary/two-factor-checkpoint — NFC + GPS in audit context.