SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC6.2: CC6.2 Registering and authorising users before issuing credentials
SOC 2 SOC2-CC6.2 covers CC6.2 Registering and authorising users before issuing credentials. The held text names 4 evidence records for it, the first being Access request tickets with owner approval for a sample of new users, service accounts and API credentials. The common gap an assessor flags is Accounts created without a recorded approval.
Before system credentials are issued and access is granted, internal and external users whose access the organisation administers are registered and authorised; their credentials are removed once their access is no longer authorised. Points of focus (2022 revision): every kind of credential, for employees, contractors, vendors, partner staff, systems and software, is issued only after authorisation; credentials are reviewed periodically for continued validity, including inappropriate system or service accounts; and credentials that are no longer valid are disabled, destroyed or otherwise blocked from use.
What evidence supports SOC2-CC6.2?
- User provisioningAccess request tickets with owner approval for a sample of new users, service accounts and API credentials
- User provisioningTermination records reconciled to account disablement dates
- User provisioningPeriodic credential validity review sign-offs covering human, system and service accounts, with remediation of findings
- User provisioningRevocation records for keys, tokens and certificates no longer valid
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC6.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Accounts created without a recorded approval
- Leavers retaining active accounts days or weeks after departure
- Access reviews performed but inappropriate access not removed
- Service account and API key credentials never reviewed or rotated
How it maps to ISO 27001:2022
- 5.16 high Registration and authorization of new internal and external users is identity lifecycle management.
- 5.17 high Issuing system credentials under a registration and authorization process evidences authentication information handling.
- 5.18 high Registration, authorization and removal of user access is provisioning and deprovisioning of access rights.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.