SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC7.5: CC7.5 Recovering from security incidents
SOC 2 SOC2-CC7.5 covers CC7.5 Recovering from security incidents. The held text names 3 evidence records for it, the first being Post-incident reports with root cause and corrective actions. The common gap an assessor flags is Recovery actions undocumented.
Recovery work after an identified security incident is identified, developed and carried out. Points of focus: the affected environment is returned to working order by rebuilding systems, updating software, patching and reconfiguring; the nature of the incident, recovery steps and prevention measures are communicated internally and externally as appropriate; the root cause is found; architecture or preventive and detective controls are changed to stop recurrence; lessons learned improve response and recovery procedures; and incident-recovery testing is performed periodically using scenarios weighted by how likely and how severe threats are, components that can impair availability, loss of key personnel, and revision of plans from the results.
What evidence supports SOC2-CC7.5?
- Incident recoveryPost-incident reports with root cause and corrective actions
- Incident recoveryEvidence corrective actions were implemented
- Incident recoveryRecovery test or exercise records and resulting plan updates
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC7.5, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Recovery actions undocumented
- Same root cause recurring across incidents
- Recovery procedures never tested
How it maps to ISO 27001:2022
- 5.27 high Root cause identification and recovery activities are how learning from incidents is evidenced.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.