SOC 2 · CC - Common Criteria (Security)

SOC 2 SOC2-CC7.4: CC7.4 Responding to security incidents

SOC 2 SOC2-CC7.4 covers CC7.4 Responding to security incidents. The held text names 5 evidence records for it, the first being Incident response plan with roles and contact lists. The common gap an assessor flags is Incident response plan untested in the period.

Identified security incidents are handled through a defined response programme that understands, contains, remediates and communicates them as appropriate. Points of focus: roles for designing, running and maintaining the programme are assigned, including outside help; incidents are contained, their ongoing effects mitigated and their threats ended by closing vulnerabilities and removing unauthorised access; operations and data are restored to an interim workable state; communication protocols reach affected parties; the nature and severity of each incident drive the response time frame and containment approach; vulnerabilities are remediated and the remediation documented and communicated; the design of the response is evaluated periodically; incidents are reviewed for patterns and root causes that call for system change; and in privacy engagements, unauthorised use or disclosure is reported to data subjects, authorities and others as required, and those responsible are sanctioned where appropriate. The 2022 revision frames remediation as resolving the identified vulnerabilities and, for privacy engagements, adds applying defined breach response procedures once a privacy incident is confirmed.