SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
SOC2-CC7.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC7.2 Monitoring system components for anomalies. System components and their operation are monitored for anomalies that point to malicious acts, natural disasters or errors, and anomalies are analysed to decide whether they are security events. Points of focus: detection policies, procedures and tools are in place, including governance and resourcing for event detection, threat intelligence on new threats and vulnerabilities, and logging of unusual activity; detection is designed to catch potential intrusions, inappropriate access, compromised physical barriers, unauthorised actions by authorised staff, stolen credentials, unauthorised outside access, compromised external parties and.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(1)(ii)(D) Information System Activity Review (Required) (closest match)
- 164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable) (closest match)
- 164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable) (closest match)
- 164.312(b) Audit Controls (Standard) (closest match)
- 164.312(c)(1) Integrity (Standard) (closest match)
- 164.312(e)(2)(i) Integrity Controls for Transmission (Addressable) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-23 AC-23 Data Mining Protection (closest match)
- NIST800-AU-1 AU-1 Policy and Procedures (closest match)
- NIST800-AU-2 AU-2 Event Logging (closest match)
- NIST800-AU-3 AU-3 Content of Audit Records (closest match)
- NIST800-AU-6 AU-6 Audit Record Review, Analysis, and Reporting (closest match)
- NIST800-AU-12 AU-12 Audit Record Generation (closest match)
- NIST800-AU-14 AU-14 Session Audit (closest match)
- NIST800-CA-7 CA-7 Continuous Monitoring (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records