SOC 2 · CC - Common Criteria (Security)
SOC 2 CC6.7: CC6.7 Restricting and protecting information in transmission, movement and removal
SOC 2 CC6.7 covers CC6.7 Restricting and protecting information in transmission, movement and removal. The held text names 4 evidence records for it, the first being TLS and encryption standards for data in transit. The common gap an assessor flags is Unencrypted internal or partner file transfers.
Transmission, movement and removal of information are limited to users and processes, inside or outside, that are authorised, and the information is protected while it moves. Points of focus: data loss prevention processes and tools limit who can send, move or remove information; encryption or secured channels protect data beyond connectivity points; portable media (USB sticks, backup tapes) are encrypted and physically protected as appropriate; and endpoint devices that are information assets, such as phones, tablets, laptops, desktops and sensors, are protected (the 2022 revision widened this from mobile devices).
What evidence supports CC6.7?
- Data in transitTLS and encryption standards for data in transit
- Data in transitDLP policy and alert records
- Data in transitRemovable media policy and technical enforcement
- Data in transitEndpoint management enrolment and encryption compliance report covering laptops, desktops and mobile devices
Where this requirement comes from
This is our own statement of SOC 2 CC6.7, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Unencrypted internal or partner file transfers
- USB storage unrestricted on endpoints holding customer data
- Mobile devices or desktops accessing customer data without management or encryption
How it maps to ISO 27001:2022
- 5.14 high CC6.7 restricts and protects information during transmission, movement and removal.
- 7.9 medium Restricting removal of information covers assets taken off site only partially.
- 8.12 high Restricting transmission, movement and removal of information to authorized users is leakage prevention.
- 8.24 medium Protection of information during transmission implies encryption but not a cryptographic or key management policy.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.