SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC7.3: CC7.3 Evaluating security events to identify incidents
SOC 2 SOC2-CC7.3 covers CC7.3 Evaluating security events to identify incidents. The held text names 5 evidence records for it, the first being Incident classification and severity criteria. The common gap an assessor flags is Events closed without a documented decision on whether they were incidents.
Security events are evaluated to decide whether they could cause, or have caused, a failure to meet objectives, and if so action is taken to prevent or address the failure. Points of focus: incident response procedures exist and their effectiveness is evaluated periodically; people running the security programme are told of detected events and review them; procedures analyse incidents and their impact on the system; and in privacy engagements, events are assessed for unauthorised use or disclosure of personal information and legal non-compliance, and the personal information affected is identified. The 2022 revision adds, for confidentiality engagements, assessing whether detected events could have or did expose or misuse confidential information and, where they did, identifying the information affected and acting to prevent a repeat.
What evidence supports SOC2-CC7.3?
- Incident managementIncident classification and severity criteria
- Incident managementSecurity event log showing triage decisions
- Incident managementIncident records with impact analysis
- Incident managementPrivacy impact determination for incidents involving personal information
- Incident managementConfidential-data impact assessment and corrective actions for incidents involving confidential information (confidentiality engagements)
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC7.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Events closed without a documented decision on whether they were incidents
- No criteria to decide when an event is a personal data breach
- Incident procedure never reviewed
- Incidents never assessed for exposure of confidential customer data
How it maps to ISO 27001:2022
- 5.25 high Evaluating security events to decide whether they are incidents is exactly this assessment control.
- 6.8 medium Event evaluation presumes a reporting channel but SOC 2 does not require a defined reporting mechanism.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.