{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","framework":"soc2","type":"preventive"},"canonicalUrl":"https://controlsmap.com/frameworks/soc2/","description":"The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.","details":{"automation":"hybrid","control_category":"technical","control_id":"CC6.3","control_type":"preventive","domains":["Access Control & Identity Management"],"framework":"soc2","group":"Common Criteria (Security)","key_control":true,"requirement_frequency":null,"requirement_status":null,"risk_count":7,"source_pages":null,"source_url":null},"id":"ctrl:soc2:CC6.3","mapUrl":"https://controlsmap.com/?v=1&node=ctrl%3Asoc2%3ACC6.3","sourceIds":["soc2"],"sourceUrl":null,"title":"CC6.3 — The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.","type":"control"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1ffa1b9a4f7392dad928a080fcb54d34c08c9839b31b6508e8e63587e7163858","properties":{"control_id":"CC6.3","coverage":"partial","delta":"modifying/removing access on change and periodic role review handled by companion controls","framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/ctrl-soc2-cc6-3-4ade392f.json","targetId":"ctrl:soc2:CC6.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c32b3778a69afd89df946c6c57476030f88c4e0b2610085353e7f87ac4812f2c","properties":{},"sourceDetailPath":"/data/v1/records/ctrl-soc2-cc6-3-4ade392f.json","sourceId":"ctrl:soc2:CC6.3","targetDetailPath":"/data/v1/records/std-soc2-26a01d3b.json","targetId":"std:soc2","type":"belongs_to"}],"schemaVersion":1}