SOC 2 CC6.3 access removal evidence is the control that turns a termination ticket into something an auditor can sample without a guided tour. CC6.3 asks whether access is removed when it is no longer required. Most teams answer with a policy PDF and a quarterly review export. Auditors answer with a list of people who left during the observation period and a question: show me, for each in-scope system, when access actually died.
We build the evidence pipeline behind whatever GRC platform you already run. The platform stores the control; it does not watch your HRIS webhook or your RDS REVOKE.
What CC6.3 Sampling Looks Like in Practice
The AICPA Trust Services Criteria for CC6.3 are about administering and removing access. In a Type II window, sampling is typically:
- HRIS or payroll extract of terminations (and often conversions from employee → contractor, which teams forget).
- For a subset, IdP last-active / disabled-at timestamps.
- For the same subset, at least one non-SSO system: cloud IAM, Git forge, production datastore, or a homegrown admin app.
If step 3 is a screenshot taken the morning of the audit, you do not have a control. You have a scramble. Continuous collection is the same idea we use for SOC 2 evidence on internal tools.
The Record Shape Auditors Can Navigate
We store one row per (person, system, grant) with immutable close fields:
{
"subject_id": "hris:4821",
"system": "aws-iam-identity-center",
"entitlement": "prod-poweruser",
"removed_at": "2026-03-12T18:04:11Z",
"removed_by": "automation:jml-fanout",
"source_event": "hris.employment.terminated",
"ticket": "SEC-18442",
"verify_query": "identitystore:DescribeUser disabled=true"
}
removed_by=automation is fine. removed_by="" with a screenshot is not. The verify_query field is how a second engineer (or the auditor) re-runs the check without Slack archaeology.
Year stamps in this JSON are example payload fields from a log, not a claim about "current year" status. The pattern is the timestamped close, not the calendar.
SLA Is a Timestamp Diff, Not a Policy Sentence
Policy says "access removed within 24 hours." Evidence is removed_at - termination_effective_at. We compute that in the warehouse the GRC tool cannot see:
- SSO apps that SCIM-disable in minutes
- AWS permission sets that lag because someone used a local IAM user
- GitHub org membership that requires a separate API call
- Database roles granted as SQL, never as an IdP group
CC6.3 findings almost always live in the last two. Pair the evidence job with joiner-mover-leaver deprovisioning so the timestamps exist. Evidence without revocation is a dashboard of failure.
Pushing Proof Into the GRC Tool You Already Have
We do not ask you to replace the compliance platform. We emit artifacts it can attach: CSV of termination samples, per-system disable proofs, and exception rows (contractor converted, leave of absence, legal hold).
Custom collectors for homegrown apps follow the same adapter pattern as compliance automation for non-standard systems. The GRC tool remains the binder. Engineering owns the collectors and the retry log.
Ask us what your GRC platform isn't covering → rutagon.com/contact · 907-841-8407 · contact@rutagon.com.
Joiner Opposite
Movers are CC6.3 too: role change should remove old grants, not only add new. We sample "department change" events, not only terminations. The same timestamp join applies.
Legal hold / litigation preservation is an exception class: access may remain with a ticket. Mixing holds into the termination sample creates false fail. Tag them.
Multi-Account AWS
Disable Identity Center assignment and any IAM users. A terminated employee with a leftover access key in a forgotten account is the classic sample fail. Org-wide credential report plus Identity Center is the minimum AWS close-out.
SOC 2 CC6.3 access removal evidence across every account
SOC 2 CC6.3 access removal evidence is a timestamp join: HR terminated_at vs IdP disabled_at vs each system revoked_at. A screenshot of last quarter’s campaign is not CC6.3. Movers count too — department change should drop old grants, not only add new ones.
NIST AC-2 language (account management) is the public vocabulary. The engineering artifact is still per-system API success. Org-wide IAM credential report plus Identity Center assignment delete is the AWS close-out. A leftover access key in a forgotten member account is the classic sample fail.
Legal hold is an exception class. Mixing holds into the termination sample creates false fail. SLA is a diff of timestamps against a written target (same day, 24 hours — whatever you committed). “Promptly” is not a number.
Push the pack into the GRC tool you already run as attachments plus the immutable copy in log-archive. The GRC row is navigation. The parquet is truth.
Frequently Asked Questions
Is a quarterly access review enough evidence for CC6.3?
No. A review can catch stale access after the fact. CC6.3 is about removal when access is no longer required — typically termination or role change — with a timestamp close to the HR event.
What if we cannot SCIM-disable a legacy app?
Export the local user table on a schedule, match on email or employee ID, and ticket disables with a close time. Manual is acceptable if the trail is complete. Unowned local admin accounts are not.
Do leave-of-absence users count as removals?
Treat them as a documented exception class: access suspended, not terminated, with a review date. Mixing LOA into the termination sample is how you create false findings — or hide real ones.
How long should we retain CC6.3 artifacts?
At least through the observation period plus the firm's retention policy for audit workpapers. We keep the raw disable events in an append-only bucket so a later sample does not depend on IdP log retention windows.
Can we use the same pipeline for ISO 27001 access revocation?
Yes. Map the same timestamps to the ISO control your auditor named. Multi-framework mapping is cheaper than a second collector — see our multi-framework evidence approach.