SOC 2 SOC2-CC7.4: Responds to identified security incidents through defined procedures
Executes a defined incident response program once a security incident is identified, with roles and responsibilities assigned, the nature and severity of the incident understood, the active threat contained and mitigated, the underlying vulnerability remediated, operations restored to a state that meets objectives, and the incident and the actions taken communicated to affected parties, with the effectiveness of the response evaluated periodically.
What else in your programme already covers this
This control maps to 556 controls across 156 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
IR-3(2) Incident Response Testing | Coordination with Related Plans. Coordinate incident response testing with organizational elements responsible for related plans
IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]
IR-9 Information Spillage Response. Respond to information spills by: a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information involved in the system contamination; c. Alerting
IR-9(2) Information Spillage Response | Training. Provide information spillage response training [Assignment: organization-defined frequency]
IR-9(3) Information Spillage Response | Post-spill Operations. Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment:
IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel. Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls]
SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
IR-3(2) Incident Response Testing | Coordination with Related Plans. Coordinate incident response testing with organizational elements responsible for related plans
IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]
IR-9 Information Spillage Response. Respond to information spills by: a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information involved in the system contamination; c. Alerting
IR-9(2) Information Spillage Response | Training. Provide information spillage response training [Assignment: organization-defined frequency]
IR-9(3) Information Spillage Response | Post-spill Operations. Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment:
IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel. Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls]
SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
NIST800-IR-9 Information Spillage Response. Respond to information spills by: Assigning [organization-defined] with responsibility for responding to information spills; Identifying the specific information involved in the system contamination; Alerting [organization-defined] of the information spill using a
NIST800-PM-12 Insider Threat Program. Implement an insider threat program that includes a cross-discipline insider threat incident handling team
NIST800-SA-16 Developer-provided Training. Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms:
NIST800-SI-1 Policy and procedures for system and information integrity
NIST800-SI-11 Error Handling. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and Reveal error messages only to [organization-defined]
NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-RC.CO-03 Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders
NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
NIST-CSF-RS.CO-03 Information is shared with designated internal and external stakeholders
NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
12.10.7 Response procedures for PAN detection in unexpected locations
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
You are reading one control. How much of SOC 2 have you already done?
SOC 2 SOC2-CC7.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.