SOC 2 Audit Support · Abu Dhabi
Emirtech configures physical access control systems that generate audit-ready evidence aligned with SOC 2 Trust Services Criteria CC6.4 — supporting Abu Dhabi SaaS, fintech, and cloud service providers preparing for Type 1 or Type 2 attestation by their appointed CPA firm.
Get a free site survey Talk to a specialist
In short: This page covers “SOC 2 Audit Support Access Control” from the access control side. Emirtech installs and configures the access control system; it is not an auditor, certification body or legal adviser, so confirm the standard or regulation with the relevant authority or auditor. It is ADMCC-approved as a company. A site survey comes first, then a written itemised quotation.
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain. Emirtech holds no SIRA registration; Dubai CCTV, alarm and access control projects are delivered through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | The access control side of: SOC 2 Audit Support Access Control. |
| Survey and quotation | A site survey comes first, then a written, itemised quotation. There is no price list and no standard duration: cost depends on the site, and the schedule is given in the quotation. |
| Credentials | Emirtech is an ADMCC-approved security systems company. That is a company approval; ADMCC makes the final approval decision for each installation. |
| Please note | General information, not legal, audit or certification advice. Emirtech installs and configures the access control side only; it is not an auditor or certification body. Confirm the standard or regulation with the relevant authority or auditor. |
| Last reviewed | 21 October 2026 |
Emirtech Technology, founded in 2018 and operating from Mussafah M44, Abu Dhabi, supports SOC 2 audit preparation by configuring physical access control infrastructure that produces the documentary evidence service auditors require under SOC 2 Trust Services Criteria CC6.4. We are an ADMCC-approved electronic security installer covering Abu Dhabi and Al Ain, and our scope on SOC 2 engagements is strictly the technical implementation layer: door controllers, readers, server-room cages, visitor management terminals, audit-log databases, time-stamped event records, removable media controls, and the configuration of role-based access policies that map to the auditor's evidence requests. SOC 2 (Service Organization Control 2) is an AICPA-defined attestation standard covering the five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy — and is most commonly pursued by UAE-hosted SaaS providers, fintech platforms, and data processors serving US enterprise customers. Such firms may target both Type 1 (point-in-time) and Type 2 (operating effectiveness over 3-12 months) reports. We configure the physical controls that demonstrate restricted access, monitored access, periodic access reviews, escorted visitor protocols, and controlled removable media — each producing exportable evidence packs the customer's CPA firm can sample during fieldwork. To be unambiguous about our role: Emirtech is not a CPA firm, not an AICPA-registered auditor, and we do not issue SOC 2 attestation reports; the attestation engagement itself sits between the customer and their chosen Certified Public Accountant or registered service auditor. We also do not represent ourselves as an authorised SOC 2 audit consultancy, and we hold no affiliation with KPMG, Deloitte, EY, PwC, or any other audit practice operating in the UAE. To discuss a CC6.4 physical access evidence package for an upcoming SOC 2 readiness assessment or surveillance window, call +971 55 651 7843 or email [email protected].
Capabilities
Card or biometric readers on data-hall, MDF, and cage doors with role-based entitlements, anti-passback, and dual-authentication on high-sensitivity zones — mapped to your CC6.4 control matrix and ready for auditor sampling.
Time-stamped event logging on every controlled door, CCTV correlation with access events, retained for the SOC 2 Type 2 observation window. Exports in CSV or PDF for service auditor evidence requests.
Pre-registration, photo capture, NDA acknowledgement, badge issuance, and escort assignment recorded per visit. Audit trail demonstrates escorted-visitor control operating consistently across the observation period.
Locked media safes, controlled USB ports via endpoint policy coordination, sign-in/out registers for backup tapes and portable drives — evidencing the CC6.4 removable media restriction your auditor expects to see.
Whether you are scoping a first-time Type 1 readiness assessment or extending physical controls ahead of a Type 2 observation period, our Abu Dhabi engineering team produces evidence-grade access control aligned with your service auditor's request list. To discuss your CC6.4 evidence pack, call +971 55 651 7843 or request a free SOC 2 access control consultation.
Why Emirtech
All electronic security work in Abu Dhabi and Al Ain delivered under ADMCC approval — the regulatory baseline for compliant access control in the Emirate, sitting alongside your SOC 2 control framework.
Every door, reader, and policy decision is configured with the auditor's evidence request in mind — exportable logs, retained records, and clear control ownership documented from day one of the observation period.
We work alongside your appointed service auditor and internal information security lead, providing technical walkthroughs and evidence extracts on request without overstepping into attestation activities.
Operating from M44, Mussafah Industrial Area since 2018 — an Abu Dhabi engineering team delivering the work in-house, with direct support during your SOC 2 Type 2 observation window.
SOC 2 attestation is a regulated AICPA-framework engagement between the service organisation and a licensed Certified Public Accountant. Our role is the physical access control layer that produces evidence — not the audit opinion. We want this boundary stated clearly before any engagement begins.
Clarity on these boundaries is what makes the rest of the engagement work — your CPA firm gets clean evidence, you get a configured system, and nobody is mis-sold a credential we do not hold.
Common questions
Primarily CC6.4 (Common Criteria 6.4) covering restricted physical access, monitored access, periodic access reviews, escorted visitor management, physical access audit trails, and removable media controls. We configure the technical layer that produces evidence for these control activities. Adjacent criteria such as CC6.1 logical access and CC7 monitoring sit with your IT and information security teams.
No. Emirtech is not a CPA firm, not an AICPA-registered service auditor, and not an authorised SOC 2 audit consultancy. We are an ADMCC-approved electronic security installer. The SOC 2 attestation report is issued by a Certified Public Accountant or registered service auditor that you engage separately, and we are not affiliated with KPMG, Deloitte, EY, PwC, or any UAE-based SOC 2 audit practice.
Yes. For Type 1 (point-in-time control design) we configure the access control system so that control design evidence is in place at the audit cut-off date. For Type 2 (operating effectiveness over 3-12 months) we configure for sustained log retention, change discipline, and periodic access review documentation across the observation window so your service auditor can sample throughout.
Yes. Door event logs, visitor records, access review attestations, and removable media registers can be exported as CSV, PDF, or system-native reports with synchronised time stamps. We work with your information security lead and the service auditor's prepared-by-client (PBC) request list to confirm the format and field coverage expected before fieldwork begins.
Electronic security installation in Abu Dhabi falls under ADMCC approval, which Emirtech holds. Any personal data captured by the access control system — card identifiers, biometric templates, visitor records — is processed under UAE PDPL (Federal Decree-Law No. 45 of 2021). Where biometric readers are used, the data is treated as sensitive personal data and we will help your DPO document the lawful basis and consent flow.
Call +971 55 651 7843, email [email protected], or submit your scope through our quotation form. Share your draft control matrix, scoped facilities, and target SOC 2 report type (Type 1 or Type 2) and we will reply the same working day to arrange a site survey and send a written quotation after it.
SOC 2 Audit Support · Abu Dhabi
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.