SOC2-CC6.1 CC6.1 Logical access security over protected information assets
SOC2-CC6.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC6.1 Logical access security over protected information assets. Access security software, infrastructure and architecture are in place over protected information assets to guard them against security events. Points of focus: information assets are inventoried, classified and managed; logical access to hardware, data at rest, in processing and in transit, software, admin rights, mobile devices, output and offline components is limited through access control software and rules; users, devices and software prove who they are before they get in, locally or remotely; networks are segmented so unrelated parts are isolated; external points of access and the data and users passing through them are.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
ISO 27001:2022
- A.5.15 Access control (reviewed pair)
- A.8.2 Privileged access rights (reviewed pair)
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(4)(i) Information Access Management (Standard) (closest match)
- 164.308(a)(4)(ii)(A) Isolating Health Care Clearinghouse Functions (Required if applicable) (closest match)
- 164.308(a)(5)(i) Security Awareness and Training (Standard) (closest match)
- 164.308(a)(5)(ii)(D) Password Management (Addressable) (closest match)
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) (closest match)
- 164.312(a)(1) Access Control (Standard) (closest match)
- 164.312(a)(2)(i) Unique User Identification (Required) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-1 AC-1 Policy and Procedures (closest match)
- NIST800-AC-2 AC-2 Account Management (closest match)
- NIST800-AC-3 AC-3 Access Enforcement (closest match)
- NIST800-AC-6 AC-6 Least Privilege (closest match)
- NIST800-AC-7 AC-7 Unsuccessful Logon Attempts (closest match)
- NIST800-AC-9 AC-9 Previous Logon Notification (closest match)
- NIST800-AC-11 AC-11 Device Lock (closest match)
- NIST800-AC-14 AC-14 Permitted Actions Without Identification or Authentication (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records