CC7.3 Evaluating security events to identify incidents

Security events are evaluated to decide whether they could cause, or have caused, a failure to meet objectives, and if so action is taken to prevent or address the failure. Points of focus: incident response procedures exist and their effectiveness is evaluated periodically; people running the security programme are told of detected events and review them; procedures analyse incidents and their impact on the system; and in privacy engagements, events are assessed for unauthorised use or disclosure of personal information and legal non-compliance, and the personal information affected is identified. The 2022 revision adds, for confidentiality engagements, assessing whether detected events could have or did expose or misuse confidential information and, where they did, identifying the information affected and acting to prevent a repeat.

Source: SOC 2 (2017 Trust Services Criteria), CC7.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.