Frameworks / SOC 2 / SOC2-CC6.6 SOC 2
CC - Common Criteria (Security)
SOC 2 SOC2-CC6.6: CC6.6 Protection against threats from outside the system boundary Logical access security measures protect against threats originating outside the system boundary. Points of focus: the kinds of activity allowed through each communication channel are limited; identification and authentication credentials are protected when sent outside the boundary; extra authentication is required for access from outside; and boundary protection such as firewalls, demilitarised zones, intrusion detection or prevention and endpoint detection and response is configured, maintained and monitored to guard external access points against attempted and unauthorised access.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 247 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
1.2.1 1.2.1 Ruleset configuration standards for NSCs 1.2.3 1.2.3 Accurate network diagram of CDE connections 1.2.5 1.2.5 Allowed services, protocols and ports justified 1.2.6 1.2.6 Security features for insecure services in use 1.2.7 1.2.7 Six-monthly review of NSC configurations 1.3.1 1.3.1 Inbound CDE traffic restricted 1.3.2 1.3.2 Outbound CDE traffic restricted 1.3.3 1.3.3 NSCs between wireless networks and the CDE 1.4.1 1.4.1 NSCs between trusted and untrusted networks 1.4.2 1.4.2 Restricting traffic entering trusted networks from outside 1.4.3 1.4.3 Anti-spoofing measures at trusted boundary 1.4.4 1.4.4 Cardholder data stores not reachable from untrusted networks 1.5.1 1.5.1 Security controls on dual-connected devices 11.2.1 11.2.1 Detect authorized and rogue wireless access points 11.3.2 11.3.2 Quarterly ASV external vulnerability scans 11.3.2.1 11.3.2.1 External scans after significant change 11.4.2 11.4.2 Internal penetration testing annually and after change 11.4.3 11.4.3 External penetration testing annually and after change 11.4.5 11.4.5 Annual segmentation penetration testing 11.4.6 11.4.6 Service provider segmentation testing every six months 11.4.7 11.4.7 Multi-tenant providers support customer penetration testing 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic 12.10.3 12.10.3 Incident response personnel available 24/7 2.2.3 2.2.3 Primary functions with different security levels managed 2.3.1 2.3.1 Wireless vendor defaults changed or confirmed secure 4.2.1 4.2.1 Strong cryptography safeguards PAN over public networks 6.4.1 6.4.1 Public web application review or automated protection 6.4.2 6.4.2 Automated web attack detection and prevention 8.4.3 8.4.3 MFA for remote access that could reach CDE CIS-1.2 Address Unauthorized Assets CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS-12.2 Establish and Maintain a Secure Network Architecture CIS-12.3 Securely Manage Network Infrastructure CIS-12.6 Use of Secure Network Management and Communication Protocols CIS-12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS-13.10 Perform Application Layer Filtering CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.4 Perform Traffic Filtering Between Network Segments CIS-13.5 Manage Access Control for Remote Assets CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS-13.9 Deploy Port-Level Access Control CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks CIS-16.10 Apply Secure Design Principles in Application Architectures CIS-16.14 Conduct Threat Modeling CIS-18.2 Perform Periodic External Penetration Tests CIS-18.5 Perform Periodic Internal Penetration Tests CIS-4.4 Implement and Manage a Firewall on Servers CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS-6.3 Require MFA for Externally-Exposed Applications CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS-9.2 Use DNS Filtering Services CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS-9.5 Implement DMARC AC-17 Remote Access AC-17(1) Monitoring and Control AC-2(1) Automated System Account Management AC-20 Use of External Systems AC-20(1) Limits on Authorized Use AC-3 Access Enforcement AC-4(21) Physical or Logical Separation of Information Flows CA-9 Internal System Connections SA-9(2) Identification of Functions, Ports, Protocols, and Services SC-20 Secure Name/Address Resolution Service (Authoritative) SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) SC-5 Denial-of-Service Protection SC-7 Boundary Protection SC-7(12) Boundary Protection | Host-based Protection (SC-7(12)) SC-7(18) Boundary Protection | Fail Secure (SC-7(18)) SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(7) Split Tunneling for Remote Devices SC-7(8) Route Traffic to Authenticated Proxy Servers SI-4 System Monitoring SI-4(4) Inbound and Outbound Communications Traffic SI-8 Spam Protection AC-17 Remote Access AC-17(1) Monitoring and Control AC-2(1) Automated System Account Management AC-20 Use of External Systems AC-20(1) Limits on Authorized Use AC-3 Access Enforcement AC-4(21) Physical or Logical Separation of Information Flows CA-9 Internal System Connections SA-9(2) Identification of Functions, Ports, Protocols, and Services SC-20 Secure Name/Address Resolution Service (Authoritative) SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) SC-5 Denial-of-Service Protection SC-7 Boundary Protection SC-7(12) Boundary Protection | Host-based Protection (SC-7(12)) SC-7(18) Boundary Protection | Fail Secure (SC-7(18)) SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(7) Split Tunneling for Remote Devices SC-7(8) Route Traffic to Authenticated Proxy Servers SI-4 System Monitoring SI-4(4) Inbound and Outbound Communications Traffic SI-8 Spam Protection 5.21 Managing information security in the ICT supply chain 5.23 Information security for use of cloud services 5.7 Threat intelligence 6.7 Remote working 7.12 Cabling security 7.9 Security of assets off-premises 8.1 User endpoint devices 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.23 Web filtering ANSSI-HYG-13 Prefer Strong Authentication Where Possible ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations ANSSI-HYG-19 Segment the Network and Partition the Zones ANSSI-HYG-20 Secure Wi-Fi Access Networks and Separate Usage ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway ANSSI-HYG-23 Partition Internet Facing Services from the Rest of the Information System ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers ANSSI-HYG-32 Secure the Network Connection of Devices Used for Mobile Working 5.7 Threat intelligence 6.7 Remote working 7.12 Cabling security 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.23 Web filtering 8.27 Secure system architecture and engineering principles 8.7 Protection against malware ASBv3-GS-4 Define and implement network security strategy ASBv3-NS-6 Deploy web application firewall IM-6 Use strong authentication controls LT-4 Enable network logging for security investigation NS-1 Establish network segmentation boundaries NS-2 Secure cloud services with network controls NS-3 Deploy firewall at the edge of enterprise network NS-5 Deploy DDOS protection C5-COS-01 Technical safeguards C5-COS-02 Security requirements for connections in the Cloud Service Provider's network C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-COS-04 Cross-network access C5-COS-05 Networks for administration C5-COS-06 Segregation of data traffic in jointly used network environments C5-IDM-09 Authentication mechanisms ASD37-07 Web content filtering (Excellent) ASD37-08 Deny direct internet connectivity (Excellent) ASD37-14 Block spoofed emails (Very Good) ASD37-22 Network segmentation (Excellent) ASD37-25 Software firewall - inbound (Very Good) ASD37-32 Network-based IDS/IPS (Limited) 6.10 Communications security 6.10.1 Network security management 6.12.1 Information security in supplier relationships 6.3.2 Mobile devices and teleworking 6.6.4 System and application access control 6.9.2 Protection from malware NIST-CSF-DE.CM-02 The physical environment is monitored to find potentially adverse events NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage CE-AC.7 MFA for Administrative Accounts CE-FW.1 Boundary Firewalls Deployed CE-FW.3 Block Unauthenticated Inbound Connections CE-FW.4 Approve and Document Inbound Rules 3.1.3e Employ Secure Information Transfer Solutions 3.13.1e Create Diversity in System Components to Limit Malicious Code Propagation 3.5.1e Identification of Systems, Components, and Devices E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1 SOC3-LOGICAL-ACCESS Logical Access CPS234-21 Implementation of Information Security Controls AUCDR-IS-2 Secure the network and systems within the data environment Art.21.2.g Basic cyber hygiene practices and cybersecurity training Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CC - Common Criteria (Security) You are reading one control. How much of SOC 2 have you already done? SOC 2 SOC2-CC6.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 247 it maps to, and the evidence behind each claim, over MCP and REST.