SOC2-CC6.7 CC6.7 Restricting and protecting information in transmission, movement and removal
SOC2-CC6.7 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC6.7 Restricting and protecting information in transmission, movement and removal. Transmission, movement and removal of information are limited to users and processes, inside or outside, that are authorised, and the information is protected while it moves. Points of focus: data loss prevention processes and tools limit who can send, move or remove information; encryption or secured channels protect data beyond connectivity points; portable media (USB sticks, backup tapes) are encrypted and physically protected as appropriate; and endpoint devices that are information assets, such as phones, tablets, laptops, desktops and sensors, are protected (the 2022 revision widened this from mobile.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.310(d)(1) Device and Media Controls (Standard) (closest match)
- 164.310(d)(2)(iii) Accountability (Addressable) (closest match)
- 164.312(a)(1) Access Control (Standard) (closest match)
- 164.312(a)(2)(iv) Encryption and Decryption (Addressable) (closest match)
- 164.312(e)(1) Transmission Security (Standard) (closest match)
- 164.312(e)(2)(i) Integrity Controls for Transmission (Addressable) (closest match)
- 164.312(e)(2)(ii) Encryption of Transmissions (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-3 AC-3 Access Enforcement (closest match)
- NIST800-AC-4 AC-4 Information Flow Enforcement (closest match)
- NIST800-AC-12 AC-12 Session Termination (closest match)
- NIST800-AC-14 AC-14 Permitted Actions Without Identification or Authentication (closest match)
- NIST800-AC-17 AC-17 Remote Access (closest match)
- NIST800-AC-18 AC-18 Wireless Access (closest match)
- NIST800-AC-24 AC-24 Access Control Decisions (closest match)
- NIST800-AU-9 AU-9 Protection of Audit Information (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records