CC6.8 Preventing and detecting unauthorised or malicious software

Controls prevent, or detect and respond to, the introduction of unauthorised or malicious software. Points of focus: only authorised people can install applications and software; changes to software and configuration that may signal malicious code are detected; software is implemented through a management-defined change process; utility software able to bypass normal operating or security procedures is restricted to authorised people and its use monitored (added in 2022); anti-malware on servers and endpoints is configured, kept current and used to remove what it detects; and assets received from outside or returned to the organisation are scanned and cleaned before joining the network.

Source: SOC 2 (2017 Trust Services Criteria), CC6.8. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.