← Index
Wireframe In Progress

Compliance Browser

Round 1 Created 2026-05-23 Section Knowledge · Compliance
Desktop
Knowledge › Compliance › SOC 2 · CC6 CC6.1 — Logical access controls
Browse Gaps Cross-framework
6frameworks 412controls 14gaps 94%coverage
Frameworks
6
Filter frameworks…
SOC 2 374
CC1 · Control environment 8
CC2 · Communication 6
CC3 · Risk assessment 5
CC4 · Monitoring activities 4
CC5 · Control activities 7
CC6 · Logical & physical access 211
CC7 · System operations 12
CC8 · Change management 5
CC9 · Risk mitigation 4
A1 · Availability 7
C1 · Confidentiality 5
ISO 27001:2022 493
HIPAA Security 254
GDPR Articles 199
NIST CSF 2.0 3106
PCI-DSS 4.0 178
Controls · SOC 2 / CC6
11
All Gaps High Med Low
CC6.1 Logical access controls 14 activities · high relevance 0.92
CC6.2 User registration & auth 11 activities · high 0.88
CC6.3 Role-based access 8 activities · high 0.78
CC6.4 Privileged access reviews 6 activities · high 0.71
CC6.5 Removal of access 7 activities · medium 0.62
CC6.6 External access boundaries 5 activities · medium 0.55
CC6.7 Transmission of data 0 activities · GAP 0.00
CC6.8 Malicious software prevention 9 activities · high 0.82
CC6.9 Asset disposal 1 activity · GAP 0.18
CC6.10 Physical access 4 activities · low 0.64
CC6.11 Environmental protections 3 activities · low 0.58
SOC 2 · CC6 · CC6.1

Logical access controls

Relevance · high 14 activities Coverage 0.92 Mapped across 4 frameworks

Statement

SOC 2 TSC 2017 · revised 2026

The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives. Controls include identification and authentication, authorization and access management, and segregation of duties across personnel performing administrative and operational activities.

Properties

7 attributes
frameworkSOC 2 (AICPA TSC 2017) domainCC6 · Logical & Physical Access typeTrust Services Criterion audit cycleAnnual · next 2027-Q1 last updated2026-05-19 (model v4) ontology revsoc2.v2026.2 (3d ago) control ownerCISO (typical) audit evidenceAccess logs · IAM config · review attestations

Mapped activities

14 · sorted by coverage
act-iam-001 Centralized identity provider deployment capabilities.iam · core Full 0.96
act-iam-002 MFA enforcement for privileged accounts capabilities.iam · core Full 0.94
act-iam-014 Quarterly access certification reviews capabilities.iam · governance Full 0.91
act-iam-022 Privileged-access workstation isolation capabilities.iam · privileged Full 0.87
act-net-018 Network segmentation for sensitive workloads capabilities.network · architecture Full 0.84
act-sec-040 SIEM ingestion of authentication events capabilities.security · monitoring Partial 0.72
act-iam-031 Just-in-time access provisioning for ops capabilities.iam · privileged Partial 0.61

Cross-framework alignment

This activity satisfies controls in 4 of 6 frameworks
Activity
SOC 2
ISO 27001
NIST CSF
HIPAA
PCI-DSS
act-iam-001 · IdP deployment
act-iam-002 · MFA enforcement
act-iam-014 · Access reviews
act-iam-022 · PAW isolation

Accounts where this control is in scope

9 of 14 · sorted by opportunity
Acme Corp manufacturing · 12k FTE audit Q3 0.87
Globex Industries manufacturing · 8k FTE audit Q4 0.71
Initech Holdings financial services · 4k FTE audit Q2 0.64
Soylent Group food & ag · 2k FTE audit Q3 0.58
Hooli Inc technology · 18k FTE audit annual 0.52