Skip to main content

⭐ Repository → 💼 SOC 2

💼 CC7 System Operations

  • ID: /frameworks/soc-2/cc7

Description​

Empty...

Similar​

  • Internal
    • ID: dec-b-f28f92c5

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.51216no data
　💼 CC7.1-1 Uses Defined Configuration Standards45no data
　💼 CC7.1-2 Monitors Infrastructure and Software811no data
　💼 CC7.1-3 Implements Change-Detection Mechanisms3no data
　💼 CC7.1-4 Detects Unknown or Unauthorized Components3no data
　💼 CC7.1-5 Conducts Vulnerability Scansno data
💼 CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.4918no data
　💼 CC7.2-1 Implements Detection Policies, Procedures, and Tools7no data
　💼 CC7.2-2 Designs Detection Measures7no data
　💼 CC7.2-3 Implements Filters to Analyze Anomalies918no data
　💼 CC7.2-4 Monitors Detection Tools for Effective Operation1no data
💼 CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.72no data
　💼 CC7.3-1 Responds to Security Incidents2no data
　💼 CC7.3-2 Communicates and Reviews Detected Security Events2no data
　💼 CC7.3-3 Develops and Implements Procedures to Analyze Security Incidents2no data
　💼 CC7.3-4 Assesses the Impact on Confidential Information2no data
　💼 CC7.3-5 Determines Confidential Information Used or Disclosed2no data
　💼 CC7.3-6 Assesses the Impact on Personal Informationno data
　💼 CC7.3-7 Determines Personal Information Used or Disclosedno data
💼 CC7.4 The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.14no data
　💼 CC7.4-1 Assigns Roles and Responsibilitiesno data
　💼 CC7.4-2 Contains and Responds to Security Incidentsno data
　💼 CC7.4-3 Mitigates Ongoing Security Incidentsno data
　💼 CC7.4-4 Resolves Security Incidentsno data
　💼 CC7.4-5 Restores Operationsno data
　💼 CC7.4-6 Develops and Implements Communication Protocols for Security Incidentsno data
　💼 CC7.4-7 Obtains Understanding of Nature of Incident and Determines Containment Strategyno data
　💼 CC7.4-8 Remediates Identified Vulnerabilitiesno data
　💼 CC7.4-9 Communicates Remediation Activitiesno data
　💼 CC7.4-10 Evaluates the Effectiveness of Incident Responseno data
　💼 CC7.4-11 Periodically Evaluates Incidentsno data
　💼 CC7.4-12 Applies Breach Response Proceduresno data
　💼 CC7.4-13 Communicates Unauthorized Use and Disclosureno data
　💼 CC7.4-14 Application of Sanctionsno data
💼 CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents.6no data
　💼 CC7.5-1 Restores the Affected Environmentno data
　💼 CC7.5-2 Communicates Information About the Incidentno data
　💼 CC7.5-3 Determines Root Cause of the Incidentno data
　💼 CC7.5-4 Implements Changes to Prevent and Detect Recurrencesno data
　💼 CC7.5-5 Improves Response and Recovery Proceduresno data
　💼 CC7.5-6 Implements Incident Recovery Plan Testingno data