Controls prevent or detect unauthorized or malicious software

What an auditor asks for

An assessor checks that endpoints and build systems run a control that flags unauthorized software, and reviews what happened to a recent finding.

• Malware control status
• Finding ticket

Evidence ShipReady collects for CC6.8

ShipReady maps CC6.8 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• CI/CD and source controlgithub-posture
• Configuration exportendpoint-posture

Common gaps

• No artifact has been collected yet — ShipReady records the CC6.8 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC6.1 — Logical access security protects information assets
• CC6.2 — User access is provisioned, modified, and removed on a managed basis
• CC6.3 — Access rights are granted on least-privilege and segregation-of-duties basis
• CC6.6 — Boundary protections restrict access from outside the system
• CC6.7 — Information in transit and at rest is protected with encryption