Criterion CC6.2Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

What it says

Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

SOC 2, the trust services criteria, CC6.2

What is in the packs for this

From SOC 2 Report Readiness. Each one helps with this requirement.

• XLSExcel

  Trust Services Criteria Response Register

  The register has a row for this criterion, for you to write down your own controls, owners and evidence against it. Lists the 61 Trust Services Criteria by number and series title, with blank columns for your own controls, owners and evidence. It makes no coverage claim.
• XLSExcel

  Control Owner & Evidence Plan

  Its Framework References cite this criterion. Records who owns each control the examination will test, what evidence it leaves, how often, and how the evidence is sampled over the period.