CC6.2: Provisioning and deprovisioning
CC6.2 findings are the ones a former employee can still use: an active Google account, a GitHub membership, an AWS key. Deixic closes each one, reads it back, and keeps the receipt.
What CC6.2 asks
CC6.2 asks that the company approve a person before issuing credentials, and remove credentials when the person no longer needs them.
The auditor samples hires and terminations and checks that each account matches an approved record and ended on time.
Source: AICPA Trust Services Criteria (2017, with revised points of focus 2022). This page paraphrases the criterion.
Tests that fail, and what Deixic does
Each row is a test from your compliance platform and the change Deixic makes in the connected system.
| Failing test | What Deixic does | Authority |
|---|---|---|
| Terminated employees lose access by the policy deadlineRippling, Gusto, Google Workspace, GitHub, AWS, Slack | Reads the termination in the HR system, suspends the Google Workspace user, removes the GitHub membership, ends AWS SSO assignments, and deactivates the Slack account. | Runs under written policy |
| Access keys of former employees are inactiveAWS | Sets each access key owned by a terminated user to inactive. | Runs under written policy |
| No stale IAM usersAWS | Deletes IAM users with no console sign-in or key use in 180 days. A user active inside 180 days is refused and sent to you. | Runs under written policy |
| No permanent administrator accessAWS | Removes persistent AdministratorAccess from named engineers and leaves 1-hour admin access through an elevation request. | Waits for a named approver |
| Every account matches a hire on recordRippling, Gusto, Google Workspace, GitHub | Compares accounts with the hires recorded in the HR system and lists each account with no matching hire. | Goes to you as a decision |
What waits, and what Deixic refuses
Approvals name a person and record a reason. Decisions are actions outside the authority your policy grants.
Waits for a named approver
- Removing permanent administrator access from named engineers in AWS.
- Suspending a terminated user who owns shared files or sole-admin repositories. The approver confirms who takes ownership first.
Never run without your decision
- Deleting any account used in the last 180 days. Deixic refuses and shows the last use.
- Setting the revocation deadline when the policy has none: immediately, within 4 hours, or within 24 hours.
- An account with no matching hire. Deixic lists it and waits for you to say who owns it.
- A termination the HR system later reversed.
What Deixic reads back
After each change Deixic reads the setting from the system itself.
| System | Read back |
|---|---|
| Google Workspace | User state is suspended and the last sign-in precedes the termination. |
| GitHub | The member is absent from the organization member list. |
| AWS | Access key status, IAM user list, and IAM Identity Center assignments. |
| HR system | Termination date and status, read before and after. |
Evidence your auditor receives
One signed, hash-linked receipt per change, exported as PDF, HTML, or JSON.
- Termination record with date from the HR system
- Per-system revocation timestamps against the policy deadline
- The deleted or suspended accounts with their last-use dates
- The refusal and your decision for any account Deixic did not touch
- Approver and reason for administrator removals
- The re-run result of the test in your compliance platform