SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC7.2: CC7.2 Monitoring system components for anomalies
SOC 2 SOC2-CC7.2 covers CC7.2 Monitoring system components for anomalies. The held text names 4 evidence records for it, the first being Logging standard and SIEM or log platform coverage of in-scope systems. The common gap an assessor flags is Key systems not sending logs to the monitoring platform.
System components and their operation are monitored for anomalies that point to malicious acts, natural disasters or errors, and anomalies are analysed to decide whether they are security events. Points of focus: detection policies, procedures and tools are in place, including governance and resourcing for event detection, threat intelligence on new threats and vulnerabilities, and logging of unusual activity; detection is designed to catch potential intrusions, inappropriate access, compromised physical barriers, unauthorised actions by authorised staff, stolen credentials, unauthorised outside access, compromised external parties and unauthorised hardware or software; anomalies are filtered and analysed to identify events; and the detection tools themselves are checked for effective operation.
What evidence supports SOC2-CC7.2?
- Security monitoringLogging standard and SIEM or log platform coverage of in-scope systems
- Security monitoringAlert rules and sample of triaged alerts
- Security monitoringThreat intelligence sources in use
- Security monitoringEvidence detection tools are health-checked (for example log source outage alerts)
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC7.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Key systems not sending logs to the monitoring platform
- Alerts with no triage record
- Log ingestion failures unnoticed for weeks
How it maps to ISO 27001:2022
- 7.4 medium Monitoring for anomalies covers system components; physical surveillance is not explicitly required.
- 8.15 high Monitoring system components for anomalies requires the event logs this control demands.
- 8.16 high Monitoring components and analysing anomalies indicative of malicious acts is the monitoring activity.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.