SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC7.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC7.1 Detecting configuration changes and new vulnerabilities. Detection and monitoring identify configuration changes that introduce vulnerabilities and exposure to newly discovered vulnerabilities. Points of focus: configuration standards are defined; infrastructure and software are monitored for departures from them; change-detection such as file integrity monitoring alerts staff to unauthorised changes to critical system, configuration or content files; unknown or unauthorised components are detected; and vulnerability scans run periodically and after significant change, with identified weaknesses acted on promptly enough to support objectives; the 2022 revision ties configuration.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(i) Security Management Process (Standard) (closest match)
- 164.308(a)(1)(ii)(B) Risk Management (Required) (closest match)
- 164.308(a)(1)(ii)(D) Information System Activity Review (Required) (closest match)
- 164.308(a)(5)(i) Security Awareness and Training (Standard) (closest match)
- 164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable) (closest match)
- 164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable) (closest match)
- 164.308(a)(6)(i) Security Incident Procedures (Standard) (closest match)
- 164.308(a)(8) Evaluation (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-7 AC-7 Unsuccessful Logon Attempts (closest match)
- NIST800-AC-9 AC-9 Previous Logon Notification (closest match)
- NIST800-AC-23 AC-23 Data Mining Protection (closest match)
- NIST800-AU-1 AU-1 Policy and Procedures (closest match)
- NIST800-AU-2 AU-2 Event Logging (closest match)
- NIST800-AU-3 AU-3 Content of Audit Records (closest match)
- NIST800-AU-4 AU-4 Audit Log Storage Capacity (closest match)
- NIST800-AU-5 AU-5 Response to Audit Logging Process Failures (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records