Information in transit and at rest is protected with encryption

What an auditor asks for

An assessor checks that data stores and transit paths named in the inventory use encryption, and samples a path to see the control is on.

• Encryption standard
• Configuration export

Evidence ShipReady collects for CC6.7

ShipReady maps CC6.7 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Configuration exportplatform-web-security
• Configuration exportsupabase-config
• Configuration exportaws-posture
• Configuration exportazure-posture
• Configuration exportgcp-posture
• Configuration exportendpoint-posture
• Configuration exportwebsite-posture
• Configuration exportmail-transport-security
• Configuration exporttls-certificate-posture

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.7 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC6.1 — Logical access security protects information assets
• CC6.2 — User access is provisioned, modified, and removed on a managed basis
• CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
• CC6.6 — Boundary protections restrict access from outside the system
• CC6.8 — Controls prevent or detect unauthorized or malicious software