Updated October 30, 2026. The original publication date is retained.
SOC 2 – CC6.3 CC6.3 addresses granting, changing and removing access in light of roles, responsibilities and system design, including least privilege and segregation of duties.
The controls and scenarios below are examples, not prescribed technologies, job titles or review intervals. Adapt them to the system and retain evidence that the process operated. See the AICPA Trust Services Criteria for the criterion and points of focus.
Authorizing or Modifying Access
How do organizations grant or change access to protected assets? The organization defines who may approve access and how the decision is recorded. The approval should reflect the person’s role, responsibilities and the system’s design.
- Sample Control: The designated owner approves access changes in a request record before implementation, according to the defined process.
- Example Scenario: Imagine a healthcare provider where nurses, doctors, and administrative staff all need different levels of access to patient records. A nurse might only need to view medical histories, while a doctor needs to make updates. The designated approver checks that the requested permissions fit the person’s duties.
Removing Access
What steps do organizations take to remove outdated access? A defined process removes or changes access when it is no longer appropriate. It may use automation or documented manual steps, with completion checked.
- Sample Control: When an employee leaves or changes roles, the responsible owner removes permissions that are no longer appropriate within the defined timeframe and retains evidence of completion.
- Example Scenario: Consider a marketing agency using a project management tool. When project access is no longer justified, the relevant permissions should be removed. A workflow can identify the access to remove; the owner verifies that the change was completed.
Types of Access Control
What kind of access control systems are commonly used? Role-based access is one way to organize permissions and support segregation of duties. Roles still need review because a role can contain excessive or conflicting access.
- Sample Control: The system assigns permissions based on predefined roles, like “Developer” or “HR Manager.”
- Example Scenario: In a financial institution, customer service reps might have read-only access to client accounts, while account managers can make changes. Role-based controls make this segregation possible.
Periodic Review of Access
How often does a review of access permissions occur? The organization sets a review interval and reviewer based on risk, commitments and control design. CC6.3 does not prescribe one universal quarterly schedule or require that IT alone make every decision.
- Sample Control: At the defined interval, responsible owners review access roles and permissions, record decisions, and track required changes to completion.
- Example Scenario: In a university setting, professors, administrators, and students all have different access needs. Regular audits can catch any inappropriate access, like a student who still has access to a course system after dropping out.
Modifying Access Rules
How do organizations update access roles and rules? The organization updates access roles and rules based on the findings of periodic reviews.
- Sample Control: Changes to roles or rules receive the approvals and checks specified by the organization’s change process, with evidence retained.
- Example Scenario: In a fast-growing startup, roles can change quickly. An employee might start as a generalist but later specialize. Their access needs will change, and the system must adapt.
For a practical review workflow, see user access review decisions, corrections and evidence.
2 Responses