SOC 2 CC6.7: Restricting the Transmission, Movement, and Removal of Information

SOC 2 CC6.7 requires that information is protected when it is transmitted, moved, or removed, and that only authorized users and processes can do so. It sits in the CC6 series (Logical and Physical Access Controls), and a frequent finding under it is data that is well protected while it sits still but travels or gets copied into lower environments without the same care.

What does SOC 2 CC6.7 require?

In plain terms, CC6.7 is about data in motion and data leaving the building. It covers two questions: who is allowed to move information out of the system, and how that information is protected while it moves. Movement includes network transmission, copying data to removable media, carrying it on a laptop or phone, and transferring it to an external party.

The criterion pairs a restriction with a protection. The restriction is that transmission, movement, and removal happen only through authorized users and processes, which is where data loss prevention and access controls apply. The protection is that whatever moves is encrypted or carried over a secured channel, so a copy intercepted in transit or a lost USB drive does not expose the data.

CC6.7 reaches beyond the network into endpoints and portable media. A phone that syncs company mail, a laptop that holds a local copy of a dataset, and a backup tape carried offsite all fall within its scope, which is why endpoint and mobile-device protection appear among its points of focus.

What are the CC6.7 points of focus?

The AICPA defines 4 points of focus for CC6.7. Because the Trust Services Criteria are AICPA copyrighted material, the points of focus below are paraphrased and grouped by theme rather than reproduced verbatim; consult the official TSC document for exact wording.

• Restricts the ability to transmit. Data loss prevention processes and tools limit who and what can transmit, move, or remove information, so movement out of the system is authorized rather than open to anyone with access.
• Encrypts data in motion. Encryption or secured communication channels protect information as it travels beyond the system's connectivity points.
• Protects removable media. Encryption and physical controls protect removable media such as USB drives and backup tapes, matched to the sensitivity of what they hold.
• Protects mobile devices. Laptops, phones, and tablets that act as information assets are protected, typically through disk encryption, mobile device management, and remote wipe.

How do you meet CC6.7 in cloud environments?

Cloud environments meet CC6.7 mainly through enforced encryption and controls on where data can go:

• TLS for all data in transit. Traffic between clients and the service, and between internal services, runs over TLS, with modern versions enforced and plaintext protocols disabled. This is the backbone of the encryption point of focus.
• Restricted egress and data loss prevention. Egress rules, controls on which external destinations data can reach, and DLP on collaboration and email tools limit unauthorized movement of information out of the environment.
• Endpoint and mobile controls through MDM. Company laptops and phones enforce disk encryption, screen lock, and remote wipe through mobile device management, so a lost device does not become a data exposure.
• Sanitized non-production data. Data copied into development, testing, or UAT environments is scrubbed of personal and sensitive information, so protected data does not spread into places with weaker controls.

A GRC platform does not satisfy CC6.7 on its own. It can track that an encryption policy exists, but the control is the enforced TLS, the DLP rules, and the MDM configuration; the platform records the evidence rather than being the evidence.

How do you meet CC6.7 on-prem?

On-prem environments carry the same requirements with more of the mechanics owned in-house. The data protection on-prem guide covers the detail; the shape is:

• Encrypted transport across the network. TLS or IPsec protects data moving between internal systems and to external parties, including site-to-site links.
• Encrypted and controlled removable media. Where USB drives or backup tapes are used, they are encrypted, tracked, and stored under physical control until they are sanitized under CC6.5.
• Endpoint disk encryption and management. Full-disk encryption on laptops and workstations, managed centrally, so a stolen device does not expose local data.
• Documented exceptions for legacy systems. Where an older system or device supports only unencrypted transport, the gap is recorded as a managed risk with compensating controls rather than treated as a silent failure.

Legacy constraints do not have to block an audit. A documented, justified exception for a system that can only speak an unencrypted protocol, managed as a known risk, is acceptable under SOC 2; an undocumented one is not.

Cloud vs on-prem at a glance

What evidence do auditors expect for CC6.7?

How does CC6.7 map to ISO 27001:2022?

Organizations pursuing both frameworks can reuse CC6.7 evidence directly for these Annex A controls, since both ask for encryption of data in transit and protection of the devices that carry it. The SOC 2 to ISO 27001 control mapping covers the full crosswalk across all five Trust Services Categories.

Related criteria

CC6.7 protects information as it moves across the boundary that CC6.6 defends, and the two are often tested together for remote and external access. Removable media sits in both CC6.7, which protects it in use, and CC6.5, which sanitizes it at disposal. The encryption and access controls behind CC6.7 are part of the logical access architecture set under CC6.1. The next criterion, CC6.8, turns from protecting information in motion to preventing unauthorized software from entering the system.

Frequently Asked Questions

What does SOC 2 CC6.7 mean?

SOC 2 CC6.7 requires that information is protected when it is transmitted, moved, or removed, and that only authorized users and processes can move it. In practice it covers encryption of data in transit, data loss prevention, and protection of removable media and mobile devices that carry company information.

What evidence satisfies CC6.7?

The core evidence is an encryption policy, TLS and transport encryption configurations, DLP and egress control settings, MDM and endpoint encryption reports, removable media handling records, and records showing non-production data is sanitized before it enters lower environments.

Does CC6.7 require encryption in transit?

Yes. Protecting information during transmission is one of the points of focus, and enforced TLS between clients and services, and across internal and site-to-site links, is the usual way to meet it. Where a legacy system can only use an unencrypted protocol, the gap is handled as a documented, justified risk acceptance with compensating controls.

How does CC6.7 handle non-production data?

Data copied into development, testing, or UAT environments is scrubbed of personal and sensitive information so protected data does not spread into environments with weaker controls. Auditors look for a documented sanitization procedure, a defined cadence such as every release, and evidence that each run happened.

How is CC6.7 different from CC6.6?

CC6.6 protects the system boundary from external threats: firewalls, segmentation, and stronger authentication for inbound access. CC6.7 protects the information that crosses that boundary and moves around: encryption in transit, control over who can remove data, and protection of the devices and media that carry it.