SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software
SOC2-CC6.8 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC6.8 Preventing and detecting unauthorised or malicious software. Controls prevent, or detect and respond to, the introduction of unauthorised or malicious software. Points of focus: only authorised people can install applications and software; changes to software and configuration that may signal malicious code are detected; software is implemented through a management-defined change process; utility software able to bypass normal operating or security procedures is restricted to authorised people and its use monitored (added in 2022); anti-malware on servers and endpoints is configured, kept current and used to remove what it detects; and assets received from outside or returned to the.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) (closest match)
- 164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable) (closest match)
- 164.308(a)(6)(ii) Response and Reporting (Required) (closest match)
- 164.312(b) Audit Controls (Standard) (closest match)
- 164.312(c)(1) Integrity (Standard) (closest match)
- 164.312(c)(2) Mechanism to Authenticate ePHI (Addressable) (closest match)
- 164.312(e)(2)(i) Integrity Controls for Transmission (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-19 AC-19 Access Control for Mobile Devices (closest match)
- NIST800-AC-23 AC-23 Data Mining Protection (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
- NIST800-CM-7 CM-7 Least Functionality (closest match)
- NIST800-CM-10 CM-10 Software Usage Restrictions (closest match)
- NIST800-CM-11 CM-11 User-installed Software (closest match)
- NIST800-CM-14 CM-14 Signed Components (closest match)
- NIST800-IR-4 IR-4 Incident Handling (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records