User access is provisioned, modified, and removed on a managed basis

What an auditor asks for

An assessor samples joiners, movers, and leavers and checks that access was granted, changed, or removed through the managed process.

• Access request tickets
• Joiner and leaver list

Evidence ShipReady collects for CC6.2

ShipReady maps CC6.2 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Access-control postureaccess-control
• Configuration exportonepassword-secrets

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.2 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC6.1 — Logical access security protects information assets
• CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
• CC6.6 — Boundary protections restrict access from outside the system
• CC6.7 — Information in transit and at rest is protected with encryption
• CC6.8 — Controls prevent or detect unauthorized or malicious software