System and Organization Controls (SOC) 2/Logical and physical access controls/25 of 61
CC6.3Authorizes, modifies, or removes access to data
Control family: Logical and physical access controls
Control description
The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.