SOC 2 CC6.2 access recertification evidence is the difference between "we ran a campaign" and "we can prove who decided what, when, on which entitlement." CC6.2 is about registering, authorizing, and administering access. Recertification is how you show that authorization is still valid after time passed.
A completion percentage in a GRC tool is a dashboard metric. Sampling is a set of rows: identity, system, entitlement, decision, actor, time, and — if the decision was revoke — a close timestamp on the actual removal.
What Fails Sampling
Patterns we see in mid-market packs:
- Manager approved 200 Okta apps in four minutes
- Campaign included SSO apps only; AWS and admin panels missing
- Revoke decisions with no ticket and still-active group membership
- Recertification of roles without the people in the roles
- No non-human identities (the quarterly review problem we attack in the quarterly runbook)
AICPA TSC language is control-objective, not product. Your GRC vendor's "CC6.2 mapped" checkbox does not ingest custom apps. That is compliance automation for non-standard systems.
Evidence Object We Keep Immutable
Once recorded, a decision does not get a quiet edit. Corrections are new events.
@dataclass(frozen=True)
class RecertDecision:
entitlement_id: str
reviewer_id: str
decided_at: str # RFC3339
decision: str # keep | revoke | modify
campaign_id: str
revoke_ticket: str | None
frozen=True is the point. Spreadsheets that overwrite the "approved" cell fail the "did they look" test. We append to an object store or a signed log. The GRC tool can display a copy; it is not the system of record for the decision if it allows bulk-approve without attribution.
Revocation Hooks Are Part of CC6.2
Administering access includes taking it away. A recertification campaign that cannot call SCIM, Identity Center, or a custom app's disable API is a survey. Wire revoke to the same fan-out as deprovisioning automation.
For AWS human access, recertify permission sets with last-used from CloudTrail — Identity Center access reviews.
Sampling Pack Layout
/cc6-2/{observation}/
campaign-definition.json
universe-count.txt
sample-ids.csv
decisions.jsonl
revoke-closures.csv
Auditors should open this without you narrating. If they need you to explain every folder, the control is still in your head.
See what an Access & Credential Governance Diagnostic finds → rutagon.com/contact · 907-841-8407 · contact@rutagon.com.
Defining the Universe
The campaign universe is a versioned list: systems in the system description plus any that hold production data even if GRC connectors missed them. We freeze the universe at campaign start. Adding a system mid-campaign without a delta campaign is how samples look incomplete.
Population counts (employees, contractors, NHI) go in universe-count.txt. If the IdP has 412 humans and the campaign certified 390, the pack must explain the 22 (service accounts, break-glass, joiners after kickoff). Unexplained deltas are findings.
Reviewer Quality Tests
We flag reviewers who complete more than N decisions per minute. That metric is for internal QA; we do not need to put it in the auditor's face unless asked. We do need to be able to show it. Bulk-approve APIs in GRC tools are disabled for in-scope campaigns where the vendor allows it.
Modify decisions (change role, not keep/revoke) need a ticket to the new entitlement. A "modify" with no follow-up is a keep wearing a hat.
SOC 2 CC6.2 access recertification evidence auditors can reopen
SOC 2 CC6.2 access recertification evidence is a decision log, not a campaign completion percentage. AICPA’s SOC 2 trust services criteria ask whether access remains authorized. A CSV of “approved” with no reviewer identity, no timestamp, and no revoke hook is theater.
We freeze the universe at T0: systems in the system description plus anything that holds production data the GRC connectors missed. Population counts (humans, contractors, NHI) go in the pack. If the IdP has 412 humans and the campaign certified 390, the 22 are explained (joiners, break-glass, service accounts) or they are a finding.
Reviewer quality: we flag >N decisions per minute internally. Bulk-approve APIs get disabled for in-scope campaigns when the vendor allows it. “Modify role” without a follow-up ticket is a keep wearing a hat. Revoke must call the system API (Okta, Identity Center DeleteAccountAssignment, custom admin) and record success/fail. A GRC checkbox that never reached AWS is not CC6.2.
Exception register: legal hold, break-glass, vendor-with-SOW-end-date. Mixing holds into the termination sample creates false fail. Tag them.
What we put in the CC6.2 zip the auditor actually opens
README.txt with universe freeze hash, campaign dates, GRC export filename, and the Athena query names used for last-used. decisions.parquet with user, system, entitlement, decision, reviewer, timestamp, ticket for revokes. exceptions.csv with expiry. No screenshots as the primary artifact. Screenshots are optional color for people who will not open parquet.
If the GRC vendor cannot export reviewer identity, that is a finding on the tool configuration, and we log decisions ourselves. We will not pretend a completion bar is CC6.2.
Frequently Asked Questions
Is recertification the same as an access review?
In practice vendors use the words interchangeably. For evidence, we care about attributable decisions on a defined population plus revocation. Call it whatever your auditor calls it; ship the log.
How large should the sample be?
The auditor sets sample size. Your job is a complete universe and a trail for whatever they pick. Hiding systems from the universe to make sampling easy is how findings get worse.
Can AI auto-approve low-risk entitlements?
Auto-keep without a named reviewer is the four-minute problem at machine speed. Use automation to route and revoke, not to fake review.
Do service accounts need CC6.2 recertification?
Yes. Non-human identities are in-scope for logical access. If your campaign skips them, say so as a gap and schedule the NHI program — do not imply they were certified.
What if our GRC tool cannot store immutable decisions?
Keep the system of record in your log bucket and attach exports. The platform remains the binder. That is the custom layer we build.