Access rights are granted on least-privilege and segregation-of-duties basis

What an auditor asks for

An assessor samples granted rights and checks that each right matches the person's role and does not combine duties the policy keeps apart.

• Access review export
• Role definition

Evidence ShipReady collects for CC6.3

ShipReady maps CC6.3 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database posturedb-posture
• Access-control posturesod-conflicts-register

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.3 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC6.1 — Logical access security protects information assets
• CC6.2 — User access is provisioned, modified, and removed on a managed basis
• CC6.6 — Boundary protections restrict access from outside the system
• CC6.7 — Information in transit and at rest is protected with encryption
• CC6.8 — Controls prevent or detect unauthorized or malicious software