How do you implement SOC 2 CC6.7?

Enforce HTTPS-only on all public-facing endpoints using HSTS headers and automatic HTTP-to-HTTPS redirect Use TLS 1.2 minimum (TLS 1.3 preferred), disable older protocol versions at the load balancer or CDN level Internal service-to-service communication within the VPC should also use TLS; mTLS for microservices reduces lateral movement risk (8 steps total)

What evidence is needed for SOC 2 CC6.7?

SSL Labs or equivalent scan result showing A or A+ grade for public-facing domains, dated, Load balancer / CloudFront configuration showing TLS 1.2+ minimum and HTTP redirect rule, Certificate Manager screenshot showing valid, non-expired certificates for in-scope domains, S3 Block Public Access setting screenshot at the account level, showing all four options enabled, MDM configuration screenshot showing USB/removable storage policy applied to all endpoints, Acceptable Use Policy (published and signed by personnel) including removable media restrictions.

What tools help with SOC 2 CC6.7 compliance?

AWS Certificate Manager (ACM), AWS ALB / CloudFront (TLS termination), Let's Encrypt, AWS Secrets Manager (certificate storage), AWS S3 Block Public Access, AWS CloudTrail + GuardDuty, Microsoft Intune (MDM), Jamf (macOS MDM).

How do you implement SOC 2 CC6.7?

All web application traffic must use TLS, configure the web server (Nginx, Apache, IIS) to redirect HTTP to HTTPS and disable SSLv3, TLS 1.0, TLS 1.1 VPN must use an encrypted protocol (WireGuard, OpenVPN, IPsec), never plain-text tunnels Offsite backup transfers must use SFTP, SCP, or an equivalent encrypted channel, not FTP (8 steps total)

What evidence is needed for SOC 2 CC6.7?

SSL Labs scan result for public-facing application showing TLS 1.2+ and no weak ciphers, dated, Web server TLS configuration snippet showing disabled protocols and cipher suite order, SFTP configuration or transfer log showing offsite backups use encrypted transport, VPN configuration showing encrypted protocol in use, GPO configuration export showing USB storage disabled for endpoint devices, Acceptable Use Policy including removable media section, with personnel acknowledgement records, Sample of any approved USB exceptions with written management approval.

What tools help with SOC 2 CC6.7 compliance?

Nginx / Apache (TLS config), WireGuard / OpenVPN, SFTP for backup transfers, Qualys SSL Labs (TLS verification), Active Directory GPO (USB block), Wazuh (file integrity / exfiltration detection), DLP solution if budget supports, Acceptable Use Policy.

Browse

33 controls

CC1.1

Commitment to integrity and ethical values

Control Environment

6 evidence2 controls

CC1.2

Board independence and oversight of internal control

Control Environment

3 evidence1 control

CC1.3

Organizational structure, reporting lines, and authority

Control Environment

3 evidence1 control

CC1.4

Commitment to attract, develop, and retain competent individuals

Control Environment

6 evidence2 controls

CC1.5

Accountability for internal control responsibilities

Control Environment

3 evidence1 control

CC2.1

Obtains or generates and uses relevant quality information

Communication and Information

3 evidence1 control

CC2.2

Internal communication of information to support internal control

Communication and Information

6 evidence2 controls

CC2.3

External communication regarding matters affecting internal control

Communication and Information

4 evidence1 control

CC3.1

Specifies objectives with sufficient clarity

Risk Assessment

3 evidence1 control

CC3.2

Identifies and analyzes risks to achievement of objectives

Risk Assessment

3 evidence1 control

CC3.3

Considers potential for fraud in assessing risks

Risk Assessment

3 evidence1 control

CC3.4

Identifies and assesses significant changes

Risk Assessment

3 evidence1 control

CC4.1

Selects, develops, and performs ongoing and separate evaluations

Monitoring Activities

6 evidence2 controls

CC4.2

Evaluates and communicates internal control deficiencies

Monitoring Activities

3 evidence1 control

CC5.1

Selects and develops control activities that mitigate risks

Control Activities

3 evidence1 control

CC5.2

Selects and develops general controls over technology

Control Activities

6 evidence2 controls

CC5.3

Deploys control activities through policies and procedures

Control Activities

3 evidence1 control

CC6.1

Logical access security infrastructure

Logical and Physical Access Controls

11 evidence3 controls

CC6.2

Registration and authorization prior to issuing credentials

Logical and Physical Access Controls

6 evidence2 controls

CC6.3

Role-based access management

Logical and Physical Access Controls

6 evidence2 controls

CC6.4

Physical access restrictions

Logical and Physical Access Controls

3 evidence1 control

CC6.5

Disposal and destruction of information assets

Logical and Physical Access Controls

3 evidence1 control

CC6.6

Controls against threats from outside system boundaries

Logical and Physical Access Controls

8 evidence2 controls

CC6.7Restricts transmission and movement of informationSOC 2Logical and Physical Access Controls

Official Requirement

The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes and protects it during transmission, movement, or removal to meet the entity's objectives.

Source: AICPA Trust Services Criteria (2017), incorporating COSO principles

In Plain English

Data in motion must be protected. TLS on all production traffic, VPN for remote access to internal systems, encryption on backups before they leave the building or region, and controls on removable media. If data can leave the system unencrypted, that is a gap. This also covers the API surface, external integrations must use encrypted channels.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon

View in Map →

CC6.8

Controls to prevent or detect unauthorized software

Logical and Physical Access Controls

6 evidence2 controls

CC7.1

Detection and monitoring for vulnerabilities

System Operations

8 evidence2 controls

CC7.2

Monitoring for anomalies and security events

System Operations

4 evidence1 control

CC7.3

Evaluation of security events as security incidents

System Operations

4 evidence1 control

CC7.4

Incident response program

System Operations

4 evidence1 control

CC7.5

Recovery from security incidents

System Operations

4 evidence1 control

CC8.1

Authorized change management process

Change Management

8 evidence2 controls

CC9.1

Risk mitigation for business disruptions

Risk Mitigation

4 evidence1 control

CC9.2

Vendor and business partner risk management

Risk Mitigation

4 evidence1 control

Browse

Help us build what matters.

What should we add next?

Stay Updated

On-premises implementation and evidence

Encryption in transit for all production data flows

Implementation steps

Tools / systems

Evidence artifacts

Removable media and data exfiltration controls

Implementation steps

Tools / systems

Evidence artifacts