CC6.7 Restricting and protecting information in transmission, movement and removal

Transmission, movement and removal of information are limited to users and processes, inside or outside, that are authorised, and the information is protected while it moves. Points of focus: data loss prevention processes and tools limit who can send, move or remove information; encryption or secured channels protect data beyond connectivity points; portable media (USB sticks, backup tapes) are encrypted and physically protected as appropriate; and endpoint devices that are information assets, such as phones, tablets, laptops, desktops and sensors, are protected (the 2022 revision widened this from mobile devices).

Source: SOC 2 (2017 Trust Services Criteria), CC6.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.