サイバーセキュリティGRC 17項目
SOC 2 Logical & Physical Access Control Audit
このチェックリストは英語版です。
Audits logical and physical access controls against the SOC 2 CC6 series covering provisioning, authentication, and de-provisioning.
SOC 2AICPA TSC
無料のPDFまたはWord・メールアドレスを入力してダウンロード。
Access Provisioning & Authorization
- Is logical access to systems restricted through role-based authorization approved by an owner? *
- Are new user access requests documented and approved before access is granted? *
- Is access granted based on the principle of least privilege? *
- Are privileged/administrative accounts inventoried and restricted to authorized personnel? *
Authentication
- Is multi-factor authentication enforced for remote and administrative access? *
- Does a password policy enforce complexity, length, and rotation requirements? *
- Are shared or generic accounts prohibited, or compensating controls documented where required? *
Access Review & De-Provisioning
- Are user access rights reviewed at least quarterly? *
- Is access revoked within a defined SLA upon termination or role change? *
- What is the target SLA in hours for revoking access upon termination?
- Are terminated user accounts confirmed disabled through periodic review? *
Physical Access
- Is physical access to facilities and data centers restricted to authorized personnel? *
- Are physical access rights reviewed and revoked upon termination? *
- Are visitors logged and escorted within restricted areas? *
Data Transmission & Disposal
- Is data encrypted in transit using approved protocols (TLS 1.2+)? *
- Are removable media and endpoints controlled to prevent unauthorized data movement? *
- Is media and hardware sanitized or destroyed before disposal or reuse? *
SOC 2 Logical & Physical Access Control Auditチェックリストの完全版をダウンロード
印刷しやすいPDF、または編集可能なWord文書で無料で入手できます。