Skip to content

SOC 2® network and device criteria in plain English

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at SOC 2 criteria CC6.4 to CC6.8: physical access, wiping devices, the outside edge of your network, data in transit, and malware.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

What stands between your data and the outside world, and what happens to the hardware?

The second half of the access group deals with places and paths: the buildings and equipment, the outside edge of your network, the routes data takes when it leaves, and the software that runs on your machines.

A cloud-first team carries less of this than an office-based one. The data center side usually sits with your hosting provider, which often makes its own SOC 2 report available, so your part is reading what that report says and covering what you control: laptops, home offices, and your own settings.

Where a small team starts

Turn on full-disk encryption and a screen lock on every laptop, enforce them through whatever device management you have, and write the one-line procedure for when a laptop is lost or returned.

Then make a list of what is reachable from the internet. If you can’t produce that list today, producing it is the first job.

The criteria, CC6.4 to CC6.8

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

CC6.4: Physical access to places that matter

Where the company controls buildings or equipment, entry is limited to the right people and recorded. Cloud-only companies mostly rely on their hosting provider for data centers and cover their own office or home setup.

In practice

  • Keys or badges for the office and server closet, with a sign-out sheet.
  • A visitor log at the front desk.
  • A short remote-work rule on securing laptops and screens at home.
  • A note that the hosting provider’s own report is where data center access is covered, and who reads it.

CC6.5: Wiping devices before they leave

When equipment or storage is retired, returned, or sold, its data is made unrecoverable first. That includes laptops, drives, and retired cloud resources.

In practice

  • A laptop-return checklist that includes erasing the disk or destroying its encryption key.
  • A certificate from the recycler for any hardware destroyed.
  • An asset log noting the date and method of disposal.

CC6.6: Defending against outside attackers

What can be reached from outside is protected with filtering, monitoring, and as little exposure as possible. Think firewalls, web protection, and closing the ports nobody needs.

In practice

  • Security groups or firewall rules that open only the ports in use.
  • A web application firewall or bot protection in front of the public app.
  • A regular scan of your public addresses and domains.
  • Admin consoles reachable only through single sign-on or a VPN.

CC6.7: Controlling how data moves

Only approved people and tools can send or move data out, and data in transit is protected. Typical leaks are a public sharing link, a USB stick, or a personal email account.

In practice

  • TLS on every public endpoint, with HSTS.
  • Public sharing links switched off in the shared drive.
  • A rule against copying production data to laptops, and a safe way to move customer files.

CC6.8: Stopping hostile or unapproved software

Malware and unapproved installs are how an ordinary laptop becomes an attacker’s foothold. A reviewer looks for protection that is running on every device, not only a rule saying to be careful.

In practice

  • Endpoint protection on laptops, reporting to one place.
  • Installs limited to an approved list through device management.
  • Dependency and container-image scanning in the build pipeline.
  • Mail filtering that screens attachments and links.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • How do you know every laptop is encrypted?
  • What is exposed to the internet, and who decided that?
  • What stops someone from copying customer data to a personal drive?
  • What happens to a laptop when someone leaves or loses it?
  • Who reads your hosting provider’s own report, and what do they do with what it says?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides