SOC 2 · CC - Common Criteria (Security)
SOC 2 CC6.3: CC6.3 Role-based access, least privilege and segregation of duties
SOC 2 CC6.3 covers CC6.3 Role-based access, least privilege and segregation of duties. The held text names 5 evidence records for it, the first being Role definitions and role-to-permission matrix. The common gap an assessor flags is Role changes add access without removing the old.
Rights over data, programs, functions and other protected assets is granted, changed or removed according to roles, responsibilities or system design and changes, applying least privilege and segregation of duties. Points of focus: access is created or modified on the asset owner's authorisation; it is removed when no longer needed; access structures (role-based, for example) limit privileges and separate incompatible functions; and roles and access rules are reviewed periodically for people who no longer need them (staff, contractors, vendors, partner personnel) and for system or service accounts that should not exist, and adjusted.
What evidence supports CC6.3?
- Access controlRole definitions and role-to-permission matrix
- Access controlChange-of-role tickets showing old access removed
- Access controlPrivileged access list and review evidence
- Access controlSegregation of duties rules, for example developers cannot deploy to production unaided
- Access controlRole review results covering vendor and service accounts
Where this requirement comes from
This is our own statement of SOC 2 CC6.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Role changes add access without removing the old
- Broad administrator rights assigned by default
- Role definitions never reviewed
- Vendor or service accounts left out of role reviews
How it maps to ISO 27001:2022
- 5.18 high Authorizing, modifying and removing access by role covers review and change of access rights.
- 5.3 high CC6.3 explicitly requires segregation of duties alongside least privilege in access design.
- 8.18 low Enforces role-based access and least privilege, directly restricting privileged utility use
- 8.2 high Least privilege and role based authorization is exactly restriction and review of privileged access.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.