How do you implement SOC 2 CC6.1?

Enable MFA enforcement at the identity provider level (Okta, Azure AD, or AWS IAM Identity Center), not just at the application level Set conditional access policies to block any authentication attempt without a second factor for production systems Enforce MFA for VPN and SSO sessions, not just console logins (12 steps total)

What evidence is needed for SOC 2 CC6.1?

Screenshot of MFA enforcement policy in your IdP (Okta policy, Azure Conditional Access rule) showing 'require MFA' is set, must be dated, Screenshot of a sample user's authentication log showing MFA challenge on login, Export of all production-access users confirming MFA is enrolled (Okta: Admin > Reports > Users with MFA), AWS console screenshot showing S3 bucket encryption settings (default encryption enabled), dated, RDS instance configuration showing 'Encryption: Yes' and the KMS key used, KMS key rotation policy screenshot showing automatic rotation enabled, Terraform or IaC config showing encryption enforced as code (Type II-friendly), Network architecture diagram showing VPC topology, subnet layout, and security group boundaries, Security group export showing inbound/outbound rules for production instances, no 0.0.0.0/0 on sensitive ports, Screenshot confirming dev/staging VPCs have no peering to production.

What tools help with SOC 2 CC6.1 compliance?

Okta, Azure AD / Entra ID, AWS IAM Identity Center, Duo Security, Google Workspace, AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault, AWS VPC + Security Groups + NACLs, Azure Virtual Network + NSGs, GCP VPC + Firewall Rules, Datadog NPM (visibility).

How do you implement SOC 2 CC6.1?

Deploy MFA on VPN Enforce MFA on the bastion host, SSH key alone is not sufficient for auditors; layer it with TOTP or your MFA provider push Configure Active Directory to require MFA via AD FS or a third-party integration for RDP and admin access (12 steps total)

What evidence is needed for SOC 2 CC6.1?

RADIUS configuration file or screenshot showing MFA integration with VPN, Duo admin console screenshot confirming all VPN and bastion users are enrolled, Sample VPN auth log showing successful MFA challenge (not just password auth), Active Directory policy export confirming password + MFA requirement, manage-bde -status output (Windows) showing encryption percentage and algorithm per volume, cryptsetup status output (Linux) showing encrypted volumes with cipher and key size, Inventory spreadsheet mapping each server to its drives, encryption status, and key storage location, Screenshot showing encryption is active, must include visible date and hostname, Network diagram showing VLAN assignments, firewall zones, and inter-VLAN rules, Firewall rule export showing inter-VLAN policy (auditors will sample specific rules), Screenshot of switch VLAN configuration confirming production systems are on the correct VLAN.

What tools help with SOC 2 CC6.1 compliance?

Duo Security (RADIUS), Active Directory + AD FS, WireGuard / OpenVPN with MFA plugin, CrowdStrike Falcon (session visibility), BitLocker (Windows Server), LUKS / cryptsetup (Linux), Thales Luna HSM, HashiCorp Vault, Firewall appliance (enterprise-grade), Managed switches with VLAN support, Wazuh (log collection/HIDS) (network monitoring), Security Onion (IDS/NSM).

Browse

33 controls

CC1.1

Commitment to integrity and ethical values

Control Environment

6 evidence2 controls

CC1.2

Board independence and oversight of internal control

Control Environment

3 evidence1 control

CC1.3

Organizational structure, reporting lines, and authority

Control Environment

3 evidence1 control

CC1.4

Commitment to attract, develop, and retain competent individuals

Control Environment

6 evidence2 controls

CC1.5

Accountability for internal control responsibilities

Control Environment

3 evidence1 control

CC2.1

Obtains or generates and uses relevant quality information

Communication and Information

3 evidence1 control

CC2.2

Internal communication of information to support internal control

Communication and Information

6 evidence2 controls

CC2.3

External communication regarding matters affecting internal control

Communication and Information

4 evidence1 control

CC3.1

Specifies objectives with sufficient clarity

Risk Assessment

3 evidence1 control

CC3.2

Identifies and analyzes risks to achievement of objectives

Risk Assessment

3 evidence1 control

CC3.3

Considers potential for fraud in assessing risks

Risk Assessment

3 evidence1 control

CC3.4

Identifies and assesses significant changes

Risk Assessment

3 evidence1 control

CC4.1

Selects, develops, and performs ongoing and separate evaluations

Monitoring Activities

6 evidence2 controls

CC4.2

Evaluates and communicates internal control deficiencies

Monitoring Activities

3 evidence1 control

CC5.1

Selects and develops control activities that mitigate risks

Control Activities

3 evidence1 control

CC5.2

Selects and develops general controls over technology

Control Activities

6 evidence2 controls

CC5.3

Deploys control activities through policies and procedures

Control Activities

3 evidence1 control

CC6.1Logical access security infrastructureSOC 2Logical and Physical Access Controls

Official Requirement

The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.

Source: AICPA Trust Services Criteria (2017), incorporating COSO principles

In Plain English

You have the technical building blocks in place to control who can access what: identity management, MFA, network segmentation, encryption at rest, and session controls. These aren't individual tools bolted together, they form a coherent architecture that auditors can trace from policy to implementation to evidence.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon

View in Map →

CC6.2

Registration and authorization prior to issuing credentials