CC7.1 Detecting configuration changes and new vulnerabilities

Detection and monitoring identify configuration changes that introduce vulnerabilities and exposure to newly discovered vulnerabilities. Points of focus: configuration standards are defined; infrastructure and software are monitored for departures from them; change-detection such as file integrity monitoring alerts staff to unauthorised changes to critical system, configuration or content files; unknown or unauthorised components are detected; and vulnerability scans run periodically and after significant change, with identified weaknesses acted on promptly enough to support objectives; the 2022 revision ties configuration standards expressly to hardening infrastructure and software.

Source: SOC 2 (2017 Trust Services Criteria), CC7.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.