From the course: Advanced SOC 2 Auditing: Proven Strategies for Auditing the Security, Availability and Confidentiality TSCs

Unlock this course with a free trial

Join today to access over 25,300 courses taught by industry experts.

Exploring CC6.4 - Securing physical access: Restricting facilities and protected information assets to authorized personnel

Exploring CC6.4 - Securing physical access: Restricting facilities and protected information assets to authorized personnel

From the course: Advanced SOC 2 Auditing: Proven Strategies for Auditing the Security, Availability and Confidentiality TSCs

Start my 1-month free trial Buy for my team

Exploring CC6.4 - Securing physical access: Restricting facilities and protected information assets to authorized personnel

“

- [Instructor] Welcome to our focus look at CC6.4, a criterion dedicated to the restriction of physical access to key areas, such as data centers and backup storage facilities. Here we explore how organizations ensure that only authorized personnel can access sensitive locations. CC6.4 centers on safeguarding physical locations containing critical information assets. It outlines the necessity for controlled environment where access is governed by a clear set of protocols. A few points of focus in the COSO framework to consider. First, strict processes to establish, or change physical access, should be strictly managed to ensure it's granted based on proper authorization. We should also see robust procedures that are in place to revoke access when it's no longer necessary, maintaining security integrity. And lastly, regular assessments are conducted to validate that access levels remain aligned with job responsibilities. Organizations are expected to demonstrate a structured method for…

Contents