SOC 2 Logical and Physical Access Controls

• CC6.1 Logical Access Security Architecture

  The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.

• CC6.2 User Registration, Authorization, and Deprovisioning

  Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

• CC6.3 Role-Based Access and Least Privilege

  The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives.

• CC6.4 Physical Access Restrictions

  The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.

• CC6.5 Secure Disposal of Physical Assets

  The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives.

• CC6.6 Protection Against External Access Threats

  The entity implements logical access security measures to protect against threats from sources outside its system boundaries.

• CC6.7 Protection of Data in Transmission, Movement, and Removal

  The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives.

• CC6.8 Prevention and Detection of Unauthorized or Malicious Software

  The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives.

Need help putting this into practice? See our SOC 2 compliance services.