👔
SOC 2 CC6.1 / CC6.3
Marcus Vance
Lead CPA Attestation Auditor"Can you walk me through what happens when an engineer needs production database access during an emergency outage? Do you have static AWS root keys or standing admin privileges?"
🛡️ Auditor Defense Playbook Recommendation:
State that no static admin credentials exist. Production access is granted via 1-hour ephemeral AWS STS tokens gated by hardware WebAuthn MFA and logged to immutable CloudTrail.
🎙️ Speak Your Defense Response
Microphone Ready--/100
Awaiting Response
Speak or submit your answer above to evaluate your readiness against AICPA CC6.0 standards.