SOC 2 · CC - Common Criteria (Security)
SOC 2 CC6.1: CC6.1 Logical access security over protected information assets
SOC 2 CC6.1 covers CC6.1 Logical access security over protected information assets. The held text names 7 evidence records for it, the first being Asset inventory with classification for in-scope systems. The common gap an assessor flags is Service accounts and API keys outside the access management process.
Access security software, infrastructure and architecture are in place over protected information assets to guard them against security events. Points of focus: information assets are inventoried, classified and managed; logical access to hardware, data at rest, in processing and in transit, software, admin rights, mobile devices, output and offline components is limited through access control software and rules; users, devices and software prove who they are before they get in, locally or remotely; networks are segmented so unrelated parts are isolated; external points of access and the data and users passing through them are inventoried and managed; access rules combine classification, data separation, port and protocol limits, identity and certificates; identification and authentication requirements are defined and managed; new infrastructure and software are registered and authorised before receiving credentials, which are removed when no longer needed; encryption protects data at rest where risk warrants; and keys are protected from generation to destruction. The 2022 revision adds: new system architectures are security-assessed before they go live; restricted components expressly include servers, storage, network elements, APIs and endpoints, with standard hardening applied; stronger authentication such as multifactor is used where the risk strategy calls for it; isolation may use zero trust designs and other techniques beyond network segmentation; cryptographic modules, algorithms, key lengths and designs suit the risk strategy; and, where confidentiality or privacy is in scope, access to confidential or personal information is limited to the purposes identified and to personnel who need it.
What evidence supports CC6.1?
- Logical accessAsset inventory with classification for in-scope systems
- Logical accessIdentity provider configuration showing MFA and password policy
- Logical accessNetwork diagrams showing segmentation or zero trust access policies for production
- Logical accessEncryption-at-rest configuration, approved algorithms and key lengths, and key management procedure
- Logical accessInventory of service and system accounts with owners
- Logical accessSecurity architecture review records for new systems before go-live
- Logical accessHardening baselines applied to servers, network devices, APIs and endpoints
Where this requirement comes from
This is our own statement of SOC 2 CC6.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Service accounts and API keys outside the access management process
- Production network flat with no segmentation
- Encryption keys stored alongside the data they protect
- New platforms deployed with no prior security architecture review
- Access to confidential or personal data broader than the stated purpose
How it maps to ISO 27001:2022
- 5.15 high Logical access security software, infrastructure and architectures are the access control implementation.
- 8.27 medium Implementing security architectures partially evidences secure engineering principles.
- 8.3 high Logical access security over protected information assets restricts access to information and functions.
- 8.5 high Logical access security software and architectures include the authentication mechanisms assessed here.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.