polara labs

SOC 2 · Trust Services Criteria · 2 min read

SOC 2 CC6.7: data in transit, explained for startups

What CC6.7 asks you to show about data in transit, and what proves it.

Data moving between systems, or out of the company, is protected and goes only where it should. Encrypt traffic with current TLS, control which devices can hold company data, and limit who can export it. Removable media is either banned or controlled.1

CC6.7 is a common criterion, so it is part of every SOC 2 report.

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC6.7, the usual records are these.

  • TLS configuration for public endpoints
  • Device management settings for laptops
  • Data loss prevention or export controls, where used

What Polara asks about it

The free readiness assessment asks 5 questions that bear on CC6.7. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

  • Are all company laptops configured with full disk encryption? If yes, show it: MDM dashboard showing encryption compliance, FileVault/BitLocker compliance report, or disk encryption policy screenshot. If no, the fix: enforce full disk encryption on every company laptop and export the compliance report.
  • TLS for all external connections? If yes, show it: SSL Labs rating screenshot, Cloudflare or AWS load balancer Transport Layer Security (TLS) settings, load balancer TLS configuration export, or security scanner report. If no, the fix: enforce Transport Layer Security (TLS) on every external endpoint and export the TLS configuration.
  • Removable media allowed? If no, the fix: block removable media on company devices, or allow only encrypted and authorized media.
  • If removable media is allowed, is it encrypted? If no, the fix: enforce encryption on removable media or prohibit removable media.

It also asks, for context:

  • Encryption standard for data in transit.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Cryptography Policy covers CC6.7.

Free templates that help, printed in full with Word, PDF or Excel downloads:

Connected systems that pull evidence for it:

  • Amazon Web Services, S3 bucket encryption: server-side encryption at rest settings on each S3 bucket.
  • Amazon Web Services, RDS instance encryption: storage encryption at rest for each RDS database.
  • Amazon Web Services, KMS keys: customer-managed encryption keys per region.
  • Google Cloud, Storage buckets: cloud Storage buckets with their default encryption at rest.
  • Microsoft Entra ID, Intune managed devices: devices managed in Intune, with their encryption and compliance state.

If you also run ISO 27001, the Annex A controls A.5.14, sending information out, A.5.34, personal data protection, A.6.7, remote work, A.7.9, devices off site, A.7.10, storage media, A.8.12, data leak prevention and A.8.24, encryption ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is TLS Enforcement. The fix: enable TLS on all external-facing connections and verify with an SSL Labs scan. The proof: SSL Labs scan result or TLS configuration export showing TLS 1.2+ enforced.

An auditor asks two things about it. Is there a documented requirement for encryption in transit? Is TLS 1.2 or higher enforced on all external-facing endpoints?

Is it in your scope?

Yes, always. CC6.7 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Logical and physical access: the criteria around it

CC6.7 is one of 8 criteria in logical and physical access, CC6.1 to CC6.8. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

Before it: CC6.6, network boundaries. After it: CC6.8, malware prevention. All the criteria are on the Trust Services Criteria page, grouped by category.

Questions

What does SOC 2 CC6.7 ask a startup to show?
Data moving between systems, or out of the company, is protected and goes only where it should. Encrypt traffic with current TLS, control which devices can hold company data, and limit who can export it. Removable media is either banned or controlled.
What evidence proves CC6.7?
The usual evidence is TLS configuration for public endpoints, device management settings for laptops and data loss prevention or export controls, where used. An auditor tests it across the report period, so dated records matter more than a written promise.

Sources

  1. TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Related

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.