SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC6.8: CC6.8 Preventing and detecting unauthorised or malicious software
SOC 2 SOC2-CC6.8 covers CC6.8 Preventing and detecting unauthorised or malicious software. The held text names 5 evidence records for it, the first being Endpoint protection coverage report across servers and workstations. The common gap an assessor flags is Endpoint protection missing from some servers or containers.
Controls prevent, or detect and respond to, the introduction of unauthorised or malicious software. Points of focus: only authorised people can install applications and software; changes to software and configuration that may signal malicious code are detected; software is implemented through a management-defined change process; utility software able to bypass normal operating or security procedures is restricted to authorised people and its use monitored (added in 2022); anti-malware on servers and endpoints is configured, kept current and used to remove what it detects; and assets received from outside or returned to the organisation are scanned and cleaned before joining the network.
What evidence supports SOC2-CC6.8?
- Malware protectionEndpoint protection coverage report across servers and workstations
- Malware protectionLocal administrator and software installation restrictions
- Malware protectionFile integrity or configuration drift monitoring alerts
- Malware protectionMalware detection and remediation records
- Malware protectionList of privileged utility tools, who may run them, and usage monitoring
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC6.8, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Endpoint protection missing from some servers or containers
- Users able to install arbitrary software
- Detections logged but not remediated
- Powerful admin utilities available to all engineers with no monitoring
How it maps to ISO 27001:2022
- 8.19 high Preventing or detecting introduction of unauthorized software is control over software installation.
- 8.7 high Controls to prevent or detect and act on malicious software are anti malware controls.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.