Frameworks / SOC 2 / SOC2-CC7.5 SOC 2
CC - Common Criteria (Security)
SOC 2 SOC2-CC7.5: CC7.5 Recovering from security incidents Recovery work after an identified security incident is identified, developed and carried out. Points of focus: the affected environment is returned to working order by rebuilding systems, updating software, patching and reconfiguring; the nature of the incident, recovery steps and prevention measures are communicated internally and externally as appropriate; the root cause is found; architecture or preventive and detective controls are changed to stop recurrence; lessons learned improve response and recovery procedures; and incident-recovery testing is performed periodically using scenarios weighted by how likely and how severe threats are, components that can impair availability, loss of key personnel, and revision of plans from the results.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 227 controls across 86 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-02 Potentially adverse events are analyzed to better understand associated activities NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood NIST-CSF-ID.IM-01 Improvements are identified from evaluations NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed NIST-CSF-RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident NIST-CSF-RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied NIST-CSF-RS.MI-02 Incidents are eradicated CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls CPS234-P24 Information Security Response Plans CPS234-P25 Response Plan Content and Escalation Mechanisms ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) ASD37-34 Regular backups (Essential) ASD37-36 System recovery capabilities (Very Good) CP-10 System Recovery and Reconstitution IR-4 Incident Handling IR-8 Incident Response Plan IR-9(3) Information Spillage Response | Post-spill Operations (IR-9(3)) CP-10 System Recovery and Reconstitution IR-4 Incident Handling IR-8 Incident Response Plan IR-9(3) Information Spillage Response | Post-spill Operations (IR-9(3)) API1164-17 Wireless and Field Communications API1164-18 Field Device Security API1164-19 Safety Instrumented Systems Interface ASBv3-IR-4 Detection and analysis - investigate an incident ASBv3-IR-6 Containment, eradication and recovery - automate the incident handling ASBv3-IR-7 Post-incident activity - conduct lesson learned and retain evidence BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities C5-OPS-20 Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures C5-SIM-03 Documentation and reporting of security incidents C5-SIM-05 Evaluation and learning process IS.AR.215 Information Security Incident Response IS.D.OR.225 External Reporting of Information Security Events IS.I.OR.225 External Reporting FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement IEC62443-16 Incident response plan for operational disruptions IEC62443-17 Recovery plan for critical systems IEC62443-20 Exercises and drills for OT incidents ISO-22320-5.2 Incident management process ISO-22320-B Annex B: Incident management plan structure ISO-22320-C Annex C: Incident management task examples 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 5.27 Learning from information security incidents ISO27019-16 Incident response plan for operational disruptions ISO27019-18 Reporting obligations to authorities ISO27019-20 Exercises and drills for OT incidents 10.7.3 10.7.3 Respond promptly to critical security control failures 12.10.6 12.10.6 Plan evolved from lessons learned and industry developments 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations PCI-P2PE-21 Incident detection and classification PCI-P2PE-22 Incident response and containment PCI-P2PE-25 Post-incident review and improvement PCI-PIN-23 Regulatory reporting requirements PCI-PIN-24 Customer notification procedures PCI-PIN-25 Post-incident review and improvement PCI-SSF-21 Incident detection and classification PCI-SSF-24 Customer notification procedures PCI-SSF-25 Post-incident review and improvement PICERL-C2 System Backup PICERL-C3 Long-Term Containment PICERL-L3 Plan Improvement SOCI-CIRMP-PHYSICAL CIRMP hazard vector: Physical security and natural hazards SOCI-S30CB Statutory incident response planning SOCI-S35AB Ministerial authorisation for government assistance APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information CPS230-13 Board Accountability for Operational Risk Management CPS230-20 Prevention, Adaptation and Return to Normal Operations CIS-16.3 Perform Root Cause Analysis on Security Vulnerabilities CIS-17.8 Conduct Post-Incident Reviews UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) 10.1 Nonconformity and corrective action 10.2 Continual improvement 5.27 Learning from information security incidents 5.30 ICT readiness for business continuity 30111-3 Terms and definitions 30111-5.2 Vulnerability handling team 10.2 Nonconformity and corrective action A.8.4 Communication of incidents SSAE18-CC7.4 CC7.4 - Incident Response SSAE18-CC7.5 CC7.5 - Incident Recovery SA-PDPL-16 Data breach notification requirements SA-PDPL-17 Security incident response procedures D.1 Incident Response Planning D.2 Incident Reporting E8-BACKUP-ML1 Regular Backups (ML1) PMF-M.4 Privacy Incident Management ANSSI-HYG-37 Define and Apply a Backup Policy for Critical Components 4.4.7 Emergency and Incident Response BB-DPA-20 Sections 50-60 - Registration and Responsibilities CFTC-SS-8 Business Continuity and Disaster Recovery Plan and Resources CA-12 Deploys Through Policies and Procedures CA-ITSG33-SC-01 Security Control Catalogue CAT-D5-1 Incident planning and strategy FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) 6.13.1 Management of information security incidents and improvements ISO28001-PC-04 Supply Chain Continuity Planning ISO20000-11 Incident management 27010-16.1 Continuity of Sharing 27400-6.5 Security monitoring and incident response ITIL4-11 Incident management NFPA1600-6.3 Emergency Response Operations 3.14.4e Refresh Systems and Components from a Trusted Baseline NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation SOC-CY-S2 System Operations IM8-RES.3 Incident Response ISMSP-SYS-05 Incident Response TAIWAN-3 Data Subject Rights TANZANIA-4 Security and Cross-Border TSSR-NOT-2 Security Incident Notification TEXASTDPSA-2 Consumer Rights TRINIDAD-3 Data Subject Rights UKGDPRREG-3 Controller and Processor (Articles 24-43) OB-OPS.4 Incident Management UK-TSA-MON-02 Incident Notification CYB-5 Cyber Incident Response Plan URUGUAY-4 Security and Cross-Border VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CC - Common Criteria (Security) You are reading one control. How much of SOC 2 have you already done? SOC 2 SOC2-CC7.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 227 it maps to, and the evidence behind each claim, over MCP and REST.