CC7.1 Detection and monitoring procedures for security events are in place
To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered v.
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence of monitoring for newly discovered vulnerabilities affecting the technologies in use · Vulnerability scanner / patch tooling
- Evidence the monitoring covers infrastructure, applications and cloud configuration · SIEM / log platform
periodic reviewEvidence produced at each review
- Records of deviations detected, the assessment of them and the remediation taken · Document repository
governing documentDocuments that govern the control
- Defined configuration standards or baselines and evidence of monitoring for changes that introduce new vulnerabilities · Policy repository / GRC workspace
- Vulnerability scanning results for the period, including scope, frequency and whether scanning is authenticated · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Vulnerability scanner / patch tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Configuration monitored at build only, so drift introduced afterwards is never detected
- Scanning performed quarterly against an environment that changes daily
- Newly published vulnerabilities tracked for operating systems while application and library exposure is unmonitored
- Detected deviations recorded with no remediation timeline and no follow up
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC6.8 Controls to prevent or detect unauthorized or malicious software · CC7.2 Monitors system components for anomalies indicating malicious acts