SOC 2 criteria › CC6 Logical and physical access controls
SOC 2 CC6.6 explained
Logical access is protected against threats from outside the system boundary.
Typical controls that address CC6.6
- Firewalls and security groups
- TLS for data in transit
- Web application firewall
- VPN or zero-trust access for admin
Evidence auditors usually ask for
- Network configuration
- TLS scan
- WAF configuration
Keep CC6.6 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC6 criteria
- CC6.1: Logical access to systems and data is restricted using access controls, authentication and encryption.
- CC6.2: New users are registered and authorized before access is granted, and access is removed when no longer needed.
- CC6.3: Access is granted, changed and removed based on roles and least privilege, with periodic review.
- CC6.4: Physical access to facilities and protected assets is restricted to authorized people.
- CC6.5: Assets are disposed of securely, and data is removed when no longer needed.
- CC6.7: Data transmission, movement and removal are restricted to authorized users and processes.
- CC6.8: Controls prevent or detect unauthorized or malicious software.
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.