Criterion CC6.2Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

SOC 2, the trust services criteria, CC6.2

Criterion text: 2017 Trust Services Criteria (with revised points of focus, 2022). © 2022 Association of International Certified Professional Accountants. All rights reserved. COSO principles © 2019 Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Reproduced from copies of AICPA's published text; check it against AICPA's own before relying on it.