SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC7.1: CC7.1 Detecting configuration changes and new vulnerabilities
SOC 2 SOC2-CC7.1 covers CC7.1 Detecting configuration changes and new vulnerabilities. The held text names 4 evidence records for it, the first being Hardening standards or benchmarks for in-scope platforms. The common gap an assessor flags is Critical vulnerabilities open beyond the remediation target.
Detection and monitoring identify configuration changes that introduce vulnerabilities and exposure to newly discovered vulnerabilities. Points of focus: configuration standards are defined; infrastructure and software are monitored for departures from them; change-detection such as file integrity monitoring alerts staff to unauthorised changes to critical system, configuration or content files; unknown or unauthorised components are detected; and vulnerability scans run periodically and after significant change, with identified weaknesses acted on promptly enough to support objectives; the 2022 revision ties configuration standards expressly to hardening infrastructure and software.
What evidence supports SOC2-CC7.1?
- Vulnerability managementHardening standards or benchmarks for in-scope platforms
- Vulnerability managementConfiguration compliance scan results
- Vulnerability managementVulnerability scan reports and remediation tickets with timelines
- Vulnerability managementAsset discovery showing detection of unauthorised devices
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC7.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Critical vulnerabilities open beyond the remediation target
- Scans exclude parts of the production environment
- No defined configuration baseline to monitor against
How it maps to ISO 27001:2022
- 5.7 medium Monitoring for newly discovered vulnerabilities implies threat intake but not a threat intelligence process.
- 8.8 high Monitoring susceptibility to newly discovered vulnerabilities is technical vulnerability management.
- 8.9 high Detecting configuration changes that introduce vulnerabilities presumes defined and monitored configuration baselines.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.