SOC 2 CC6: access control evidence, all 8
CC6 is the biggest family in SOC 2 and the one that produces the most evidence. Eight criteria, and only one of them is about doors.
CC6 has eight criteria covering logical and physical access, and it is the largest family in the common criteria. It runs from how access is architected (CC6.1), through registration and authorization of users (CC6.2), through granting, modifying and removing access on least privilege (CC6.3), physical access (CC6.4), asset disposal (CC6.5), external threats (CC6.6), transmission and removal of information (CC6.7), and malicious software (CC6.8). For a cloud company, CC6.4 and half of CC6.5 are largely inherited from your infrastructure provider's own report.
8 Criteria in CC6, the largest family
2 Of them you can largely inherit from a cloud provider
What does each CC6 criterion ask for?
| Criterion | What it asks | Evidence |
|---|---|---|
| CC6.1 | Logical access security software and architecture protect information assets | Identity provider configuration, MFA enforcement report, SSO application list, network and security group configuration, encryption settings |
| CC6.2 | Users are registered and authorized before credentials are issued | Approval trail per grant: a ticket or email showing who approved before the account existed |
| CC6.3 | Access is authorized, modified and removed on roles and least privilege | Access review records, role definitions, offboarding records with timestamps |
| CC6.4 | Physical access to facilities and assets is restricted | Office access policy, and your cloud provider's SOC 2 report for the data centre |
| CC6.5 | Protections are removed from physical assets only after data is unreadable | Device disposal or wipe records, certificates of destruction, laptop return checklist |
| CC6.6 | Measures protect against threats from outside the system boundary | Firewall and WAF configuration, edge protections, VPN or zero trust configuration, external scan results |
| CC6.7 | Transmission, movement and removal of information is restricted and protected | TLS configuration and scan, disk encryption on endpoints, removable media position, data loss controls if you claim them |
| CC6.8 | Unauthorized or malicious software is prevented or detected and acted on | Endpoint protection deployment report, dependency scanning, image scanning, application allowlisting where used |
When do the access reviews have to happen?
CC6.3 is the criterion with a cycle, and the cycle has to fall inside the observation window rather than around it. A semi-annual commitment on a three month window is a problem: the auditor will look for a review inside those three months and a policy that says twice a year does not guarantee one. Either commit to a cadence that fits, or run an extra review at the start of the window so there is one to sample.
| Stated cadence | 3 month window | 6 month window | 12 month window |
|---|---|---|---|
| Quarterly | 1 | 2 | 4 |
| Semi-annual | 0 or 1 | 1 | 2 |
| Annual | 0 or 1 | 0 or 1 | 1 |
The zeros are the problem. If a cadence can produce zero reviews inside your window, run one on day one regardless of what the policy says, and then keep to the policy. What that record has to contain is covered on the access review evidence page.
We are fully remote. What about CC6.4 and CC6.5?
CC6.4 is satisfied for the infrastructure by carrying your cloud provider's SOC 2 Type 2 report on file and noting in your vendor review what you looked at in it. That is a complementary user entity control arrangement and it is normal. What is left is your own physical footprint: laptops, any office, and any paper.
For a remote company the answer is short. State that there is no company facility hosting system components, name the cloud provider report you rely on, describe how laptops are controlled (full disk encryption, endpoint management, a device inventory), and describe what happens to a laptop when somebody leaves. CC6.5 then needs one thing most companies do not have: a record that the departing employee's device was wiped or securely disposed of, not just returned. Add it to the offboarding checklist now, because it cannot be reconstructed later.
Inheriting is not the same as ignoring
An auditor will accept that your data centre physical security comes from AWS, Google Cloud or Azure. They will not accept that you never looked. Keep the provider's current report, note the date you reviewed it, and record any complementary user entity controls it lists that you are responsible for. That note is also your CC9.2 vendor review for your largest vendor, so write it once.
What CC6 evidence gets rejected?
- An MFA screenshot showing the policy exists, with no enforcement report showing every user is actually covered. The exception is always the service account or the founder.
- An access review with no reviewer name and no per-account decision. A user list export is a population, not a review.
- Grants with approval recorded after the account was created. CC6.2 says prior to issuing credentials, and the timestamps are visible.
- A user list that omits contractors, service accounts or people whose access is through a third party. The population has to be complete or the sample is meaningless.
- Offboarding records showing access removed, with no date. CC6.3 is tested against your stated removal window and a record with no timestamp cannot be tested at all.
Four of those five are population and timestamp problems rather than security problems, which is the general shape of CC6 failures. The joiners and leavers evidence page covers the sampling in detail, and the evidence tracker will build the row set for your window length.
Get all eight CC6 points covered
CC6 carries the heaviest sample in the common criteria and the most ways to fail it. Send your scope and compare firms that have taken it through fieldwork.
Get matchedCommon questions
How many criteria are in CC6?
Eight, CC6.1 through CC6.8. It is the largest common criteria family and typically accounts for the largest share of evidence requests in a first audit.
How often should we do access reviews for SOC 2?
Quarterly is the common commitment and semi-annual is defensible for a small team, but the real constraint is your observation window: at least one review has to fall inside it. For a three month window, run a review on day one whatever the policy cadence says.
Does CC6.4 apply if we have no office?
Yes, but it is short. State that no system components sit in a company facility, rely on the cloud provider's report for the data centre, and cover laptops and endpoint controls. Keep the provider report on file with a dated review note.
Do service accounts count as users under CC6.2 and CC6.3?
Yes. Service accounts, machine identities and API keys are access to protected information assets, and leaving them out of the population is one of the most common CC6 exceptions. Give each one a named human owner and include them in the review.
Is a password manager enough for CC6.1?
No. CC6.1 is about the architecture of logical access: identity, authentication, authorization and the protections around the data itself. A password manager helps with credential hygiene and does not address single sign-on, MFA enforcement, role design or encryption, all of which get tested.