Skip to main content
Control Institute

SOC 2 CC6 Access Control Checklist

Meet SOC 2 CC6 Access Control Requirements, Control by Control

Each CC6.1 through CC6.8 criterion mapped to the exact evidence an auditor requests, and whether it counts as design or operating-effectiveness evidence.

You know your controls exist. Can you prove they operated?

Your team restricts access, enforces MFA, and reviews entitlements. But when the auditor samples your audit period, a well-written policy with no supporting operational logs fails the test of controls. The hard part is not having controls, it is knowing which specific, dated, version-controlled artifact satisfies which CC6 criterion before the request list arrives. This checklist answers that, control by control.

Free 20-page checklist

Get instant access to the checklist

Written from the assessor's side of the table.
  • Every CC6.1-CC6.8 control mapped to named evidence
  • Design vs. operating-effectiveness evidence, side by side
  • Control-requirement-to-evidence tables per section
SOC 2 Access Control Checklist: Evidence for Every CC6 Control
CHECKLIST

Download the CC6 evidence checklist

Delivered to your inbox instantly.

Verifying you're human...

What is inside the 20-page checklist

CC6.1 through CC6.8, mapped to evidence.

The CC6 criterion mapping table: every checklist section tied to its CC6.1 through CC6.8 citations
Design evidence and operating-effectiveness evidence shown side by side for each control
Control-requirement-to-acceptable-evidence tables for every section
What 'authorized' precisely means to an auditor testing CC6.1
ISO/IEC 27001 Annex A.9 (Access Control) and A.8 (Asset Management) overlap noted inline
A pre-fieldwork gate check: evidence index, five sample populations, remediation log, and walkthrough narratives

What you can do once you have it

Say exactly which artifact satisfies which criterion

Trace any CC6 control point to the named evidence an auditor will sample, instead of guessing what to collect.

Catch the gaps auditors catch

See where findings emerge, so you can close them before the kickoff call rather than during fieldwork.

Assemble a package organized the way it is tested

Build evidence around how assessors pull samples, separating design proof from operating-effectiveness proof.

Collect real artifacts, not generic advice

Pull the right IdP exports, PAM logs, IAM credential reports, and ITSM tickets for each control the first time.

How each checklist item works

Start with the control objective
  • A plain statement of what the CC6 criterion requires.
Gather the design evidence
  • Documentation that proves the control exists and is designed appropriately.
Gather the operating-effectiveness evidence
  • Artifacts that prove it functioned across the full audit period.
Finish with audit readiness verification
  • Consolidate and pressure-test the package before fieldwork.

Grounded in the criteria auditors actually test

Maps to the AICPA 2017 Trust Services Criteria, CC6.1 through CC6.8

Cross-references ISO/IEC 27001 Annex A.9 (Access Control) and A.8 (Asset Management)

A CC6 criterion mapping table links each checklist section to its criteria

Control-requirement-to-evidence tables are provided for every section

Names artifact standards, such as deprovisioning requiring an HR record, an IT ticket, and a timestamped revocation confirmation

Frequently asked questions

It is an evidence verification tool. It tells you which artifacts an auditor requests for each control and what format is acceptable, not boilerplate policy language to paste in.

Know exactly what satisfies each CC6 control

Get the 20-page checklist mapping CC6.1 through CC6.8 to the evidence auditors sample.