CC6.6 Protection against threats from outside the system boundary

Logical access security measures protect against threats originating outside the system boundary. Points of focus: the kinds of activity allowed through each communication channel are limited; identification and authentication credentials are protected when sent outside the boundary; extra authentication is required for access from outside; and boundary protection such as firewalls, demilitarised zones, intrusion detection or prevention and endpoint detection and response is configured, maintained and monitored to guard external access points against attempted and unauthorised access.

Source: SOC 2 (2017 Trust Services Criteria), CC6.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.