CC6.7 Transmission of data is restricted to authorized users
Restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives.
5
artefacts
3
held by a system
1
at each review
easy
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence of protection during transmission, such as enforced transport encryption and secure file transfer · Identity provider / directory
- Controls over removable media and other portable devices, including restriction, encryption and logging · Endpoint management (MDM / EDR)
- Records of monitoring or detection of unauthorised movement of information · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence covering movement to third parties and to personal accounts or devices · Endpoint management (MDM / EDR)
governing documentDocuments that govern the control
- Restrictions on transmission, movement and removal of information, showing which users and processes are authorised · Policy repository / GRC workspace
First move
Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.
Common gaps auditors find
- Transmission protected on the primary channel while batch feeds, integrations and support extracts move data unprotected
- Removable media addressed by policy alone with no technical restriction or detection
- Personal cloud storage and personal email as an exfiltration route neither blocked nor monitored
- Encryption in transit claimed from the provider with no verification of the negotiated protocol and cipher
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC6.6 Measures against threats outside system boundaries are implemented · CC6.8 Controls to prevent or detect unauthorized or malicious software