SOC 2 · Trust Services Criteria · 2 min read

SOC 2 CC6.8: malware prevention, explained for startups

What CC6.8 asks you to show about malware prevention, and what proves it.

You stop unauthorized or malicious software from getting into your systems, and you notice when it does. Endpoint protection on laptops, controls on what can be installed, and scanning of code and containers. Alerts go to someone who acts on them.¹

CC6.8 is a common criterion, so it is part of every SOC 2 report.

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC6.8, the usual records are these.

Endpoint protection coverage reports
Device management policies that limit installs
Dependency and container scanning results

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC6.8. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

Do you use a device management tool (MDM/EDR) for company laptops? If yes, show it: MDM dashboard screenshot, device compliance report, Jamf/Intune export, or endpoint compliance summary. If no, the fix: deploy a device management tool to every company laptop and enforce the baseline configuration through it.
Do all company laptops have endpoint protection installed and kept up to date? If yes, show it: endpoint detection and response (EDR) dashboard showing device coverage, agent health report, or endpoint protection policy screenshot. If no, the fix: install endpoint protection on every company laptop and verify coverage from the console.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Asset Management Policy covers CC6.8.

Free templates that help, printed in full with Word, PDF or Excel downloads:

Asset inventory template

Connected systems that pull evidence for it:

Amazon Web Services, S3 bucket encryption: server-side encryption at rest settings on each S3 bucket.
Amazon Web Services, RDS instance encryption: storage encryption at rest for each RDS database.
Google Cloud, Storage buckets: cloud Storage buckets with their default encryption at rest.
Microsoft Entra ID, Intune managed devices: devices managed in Intune, with their encryption and compliance state.

If you also run ISO 27001, the Annex A controls A.8.1, laptops and phones, A.8.7, malware protection, A.8.18, powerful admin utilities, A.8.19, installing software and A.8.23, web filtering ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Yes, always. CC6.8 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Logical and physical access: the criteria around it

CC6.8 is one of 8 criteria in logical and physical access, CC6.1 to CC6.8. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

Before it: CC6.7, data in transit. After it: CC7.1, vulnerability monitoring. All the criteria are on the Trust Services Criteria page, grouped by category.

Questions

What does SOC 2 CC6.8 ask a startup to show?

What evidence proves CC6.8?

The usual evidence is endpoint protection coverage reports, device management policies that limit installs and dependency and container scanning results. An auditor tests it across the report period, so dated records matter more than a written promise.

Sources

TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment