SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC6.6: CC6.6 Protection against threats from outside the system boundary
SOC 2 SOC2-CC6.6 covers CC6.6 Protection against threats from outside the system boundary. The held text names 4 evidence records for it, the first being Firewall and security group rule sets with review evidence. The common gap an assessor flags is Remote access without multi-factor authentication.
Logical access security measures protect against threats originating outside the system boundary. Points of focus: the kinds of activity allowed through each communication channel are limited; identification and authentication credentials are protected when sent outside the boundary; extra authentication is required for access from outside; and boundary protection such as firewalls, demilitarised zones, intrusion detection or prevention and endpoint detection and response is configured, maintained and monitored to guard external access points against attempted and unauthorised access.
What evidence supports SOC2-CC6.6?
- Perimeter securityFirewall and security group rule sets with review evidence
- Perimeter securityMFA enforced on VPN, remote and administrative access
- Perimeter securityIntrusion detection or prevention, web application firewall and EDR configuration and alert records
- Perimeter securityTLS configuration for external endpoints
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC6.6, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Remote access without multi-factor authentication
- Inbound rules open to the internet with no business justification
- Boundary alerts generated but never reviewed
- EDR deployed but not kept current or tuned
How it maps to ISO 27001:2022
- 8.20 high Logical access measures against threats outside system boundaries are network security controls.
- 8.21 medium Boundary protection covers network services partially, without service level or security mechanism agreements.
- 8.22 high Protecting against threats outside system boundaries is enforced through network segregation.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.