Skip to content

SOC 2® access control in plain English (CC6.1 to CC6.3)

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at SOC 2 access control, CC6.1 to CC6.3: the gates in front of your systems, how accounts begin and end, and sizing access to the job.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

Who can get into what, and how do you know?

Access comes up constantly, in SOC 2 examinations and in customer questionnaires alike. CC6.1 to CC6.3 cover the logical side: the gates in front of systems and data, how accounts begin and end, and how much each account is allowed to do.

Reviewers typically work by sampling. A reviewer takes a list of current staff and a list of leavers and compares them with the accounts that exist. Tidy lists and a habit of checking them do more for you than any single tool.

Where a small team starts

Put every workplace app behind one identity provider with multi-factor sign-in, and start the leaver checklist from that provider. If an app can’t join, list it as an exception with an owner.

Then set a quarterly reminder to review who holds admin rights in the cloud account and the identity provider. Keep the export, the date, and who signed off.

The criteria, CC6.1 to CC6.3

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

CC6.1: Technical gates in front of data

Data that would hurt if exposed should sit behind technical barriers, such as strong sign-in and encryption, sized to how sensitive it is. A reviewer wants to see them working on real systems, not just described in a policy.

In practice

  • Sign-on through one identity provider, with multi-factor authentication, for workplace apps and cloud admin accounts.
  • Databases and storage in private networks, not open to the internet.
  • Encryption at rest switched on for databases and buckets.
  • An inventory of data stores showing an owner and a sensitivity level for each.

CC6.2: Approving accounts, then removing them

Accounts for people and systems are created only after approval, and removed when the need ends. Reviewers often test this by comparing a list of leavers against account lists.

In practice

  • An access request ticket, approved by a manager, before anything is provisioned.
  • An offboarding checklist that disables accounts the day someone leaves.
  • A quarterly comparison of the HR roster against the identity provider and key apps.
  • An owner named for every service account.

CC6.3: Access sized to the job

People get the access their role needs and no more, and a change of role changes their access. Sensitive tasks are split so one person can’t do and approve the same thing.

In practice

  • Groups that map to roles in the identity provider, instead of one-off grants.
  • Admin rights that are time-limited or approved case by case.
  • A periodic review where each manager confirms their team’s access.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • Show me how a new engineer gets production access, and who approved it.
  • This person left in March. When was each of their accounts turned off?
  • Who has admin rights today, and why?
  • Is multi-factor sign-in required, and how do you know nobody is exempt?
  • Where do secrets and keys live, and who can read them?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides