SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties
SOC2-CC6.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC6.3 Role-based access, least privilege and segregation of duties. Rights over data, programs, functions and other protected assets is granted, changed or removed according to roles, responsibilities or system design and changes, applying least privilege and segregation of duties. Points of focus: access is created or modified on the asset owner's authorisation; it is removed when no longer needed; access structures (role-based, for example) limit privileges and separate incompatible functions; and roles and access rules are reviewed periodically for people who no longer need them (staff, contractors, vendors, partner personnel) and for system or service accounts that should not exist, and.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.306 Security Standards: General Rules (closest match)
- 164.308(a)(3)(i) Workforce Security (Standard) (closest match)
- 164.308(a)(3)(ii)(C) Termination Procedures (Addressable) (closest match)
- 164.308(a)(4)(i) Information Access Management (Standard) (closest match)
- 164.308(a)(4)(ii)(A) Isolating Health Care Clearinghouse Functions (Required if applicable) (closest match)
- 164.308(a)(4)(ii)(B) Access Authorization (Addressable) (closest match)
- 164.308(a)(4)(ii)(C) Access Establishment and Modification (Addressable) (closest match)
- 164.310(a)(2)(iii) Access Control and Validation Procedures (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-1 AC-1 Policy and Procedures (closest match)
- NIST800-AC-2 AC-2 Account Management (closest match)
- NIST800-AC-3 AC-3 Access Enforcement (closest match)
- NIST800-AC-5 AC-5 Separation of Duties (closest match)
- NIST800-AC-6 AC-6 Least Privilege (closest match)
- NIST800-AC-7 AC-7 Unsuccessful Logon Attempts (closest match)
- NIST800-AC-10 AC-10 Concurrent Session Control (closest match)
- NIST800-AC-11 AC-11 Device Lock (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records