CC6.3: Access changes and least privilege
CC6.3 tests whether access shrinks when jobs change and whether someone reviews it. Deixic narrows access, schedules the review, and leaves the sign-off to the system owner.
What CC6.3 asks
CC6.3 asks that the company grant access by role, keep it to the minimum a person needs, and change or remove it when a role changes.
The auditor looks for administrator rights nobody uses and for a review of who holds access, with a named reviewer and a date.
Source: AICPA Trust Services Criteria (2017, with revised points of focus 2022). This page paraphrases the criterion.
Tests that fail, and what Deixic does
Each row is a test from your compliance platform and the change Deixic makes in the connected system.
| Failing test | What Deixic does | Authority |
|---|---|---|
| No unused administrator rolesAWS | Deletes administrator roles unused for 180 days with no trust relationship from an active service. | Runs under written policy |
| Quarterly access review is documented and performedGoogle Workspace, GitHub, AWS, Okta | Writes the Quarterly Access Review Procedure, assigns the owner of each connected system as reviewer, and schedules the first review. | Runs under written policy |
| Administrator access is limited to people who administerGoogle Workspace, GitHub | Lists super admins and organization owners with no admin activity in 180 days and removes the role. | Waits for a named approver |
| Outside collaborators are reviewedGitHub | Removes outside collaborators with no repository activity in 180 days. | Runs under written policy |
| Reviewers sign off on each accountGoogle Workspace, GitHub, AWS | Builds the review list for each system and sends it to the system owner. Deixic never signs a review in the owner's place. | Goes to you as a decision |
What waits, and what Deixic refuses
Approvals name a person and record a reason. Decisions are actions outside the authority your policy grants.
Waits for a named approver
- Removing the administrator role from someone who still signs in.
- Removing an outside collaborator from a repository with open pull requests.
Never run without your decision
- Signing off an access review. The system owner signs.
- Widening anyone's access. Deixic only narrows access and sends every request to widen it to the system owner.
- Removing a role used in the last 180 days without the owner's confirmation.
What Deixic reads back
After each change Deixic reads the setting from the system itself.
| System | Read back |
|---|---|
| AWS | Role list after deletion and the role's last-used date before it. |
| Google Workspace | Admin role assignments per user. |
| GitHub | Organization owner list and outside collaborator list. |
Evidence your auditor receives
One signed, hash-linked receipt per change, exported as PDF, HTML, or JSON.
- The role or membership as it stood, with its last-used date
- The access review procedure, version, and reviewer assignments
- The review list per system and the owner's sign-off
- Approver and reason for each administrator removal
- The re-run result of the test in your compliance platform