CC6.1 Logical access security
The logical access security software, infrastructure and architecture that protect information assets: identity, authentication, access paths, encryption of sensitive data and how auditors test it.
CC6 Logical and physical access controls
Common criteria series CC6: logical access security, user registration and authorization, role-based access, physical access, asset disposal, boundary protection, data transmission and malware.
CC6.2 User registration and authorization
Registering and authorizing internal and external users before issuing credentials, and removing credentials when access is no longer authorized: the joiner and leaver side of access control.
CC6.3 Role-based access and least privilege
Granting, changing and removing access to data, software and functions based on roles and responsibilities, with least privilege and segregation of duties in mind: the mover side of access control and periodic review of roles.
CC6.4 Physical access restrictions
Restricting physical access to facilities and protected information assets, such as data centers and backup media storage, to authorized personnel. For cloud-hosted systems, part of this criterion may be met by a subservice organization's controls.
CC6.5 Disposal of physical assets
Removing logical and physical protections from physical assets such as disks and devices only after data and software on them can no longer be read or recovered: secure decommissioning and media sanitization.
CC6.6 Boundary protection
Logical access security measures against threats from outside the system boundary: restricting external access, protecting credentials, additional authentication for remote or external access, and firewalls and other boundary protection systems.
CC6.7 Data transmission, movement and removal
Limiting who and what can transmit, move or remove information, and protecting it while it moves: encryption in transit, secure channels, removable media and endpoint device protection.
CC6.8 Malicious and unauthorized software
Preventing, or detecting and acting on, unauthorized or malicious software: restricting software installation, detecting unauthorized changes, anti-malware, and scanning assets that come from outside the organization.
