Logical access security protects information assets

What an auditor asks for

An assessor tries the documented access paths and checks that protected assets are not reachable without an authorized identity.

• Access configuration export
• Authentication settings

Evidence ShipReady collects for CC6.1

ShipReady maps CC6.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database posturedb-posture
• Configuration exportsupabase-config
• Configuration exportaws-posture
• Configuration exportazure-posture
• Configuration exportgcp-posture
• Configuration exportonepassword-secrets
• Access-control postureguard-access

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC6.2 — User access is provisioned, modified, and removed on a managed basis
• CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
• CC6.6 — Boundary protections restrict access from outside the system
• CC6.7 — Information in transit and at rest is protected with encryption
• CC6.8 — Controls prevent or detect unauthorized or malicious software