CC7.2 Monitoring system components for anomalies

System components and their operation are monitored for anomalies that point to malicious acts, natural disasters or errors, and anomalies are analysed to decide whether they are security events. Points of focus: detection policies, procedures and tools are in place, including governance and resourcing for event detection, threat intelligence on new threats and vulnerabilities, and logging of unusual activity; detection is designed to catch potential intrusions, inappropriate access, compromised physical barriers, unauthorised actions by authorised staff, stolen credentials, unauthorised outside access, compromised external parties and unauthorised hardware or software; anomalies are filtered and analysed to identify events; and the detection tools themselves are checked for effective operation.

Source: SOC 2 (2017 Trust Services Criteria), CC7.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.