Boundary protections restrict access from outside the system

What an auditor asks for

An assessor reviews boundary rules and checks that inbound paths from outside the system are limited to the ones the design allows.

• Boundary rule export
• Network diagram

Evidence ShipReady collects for CC6.6

ShipReady maps CC6.6 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Configuration exportplatform-web-security
• Configuration exportsupabase-config
• Configuration exportaws-posture
• Configuration exportazure-posture
• Configuration exportgcp-posture
• Configuration exporthetzner-posture
• Configuration exportemail-auth-posture
• Configuration exportdns-security-posture

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.6 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC6.1 — Logical access security protects information assets
• CC6.2 — User access is provisioned, modified, and removed on a managed basis
• CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
• CC6.7 — Information in transit and at rest is protected with encryption
• CC6.8 — Controls prevent or detect unauthorized or malicious software