CC6.2

User registration and authorization

SecurityImplementedSecurity (Common Criteria)

AICPA Trust Services Criteria

Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.

How this is tested during the audit

Auditor samples 25 new hires and contractors and traces their access requests to documented manager approvals.

1 item attached to this control

Last reviewed

14d

Within 180-day window

Evidence on file

VP Engineering

Accountable for design + operating effectiveness

Recent control history