CC7.3 Evaluates security events to determine incident status
Evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of events evaluated during the period, including those determined not to be incidents, with the reasoning · Document repository
- Evidence of who performs the evaluation and their authority to declare an incident · Document repository
- Evidence of the actions taken to prevent or address a failure, following the determination · Document repository
- Evidence of communication of the determination to those who need to act on it · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The criteria for evaluating whether a security event could result or has resulted in a failure to meet objectives · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Only declared incidents are documented, so the evaluation step itself leaves no evidence and cannot be tested
- Evaluation criteria informal, producing inconsistent determinations between shifts and individuals
- Determination made without reference to the entity's service commitments, so customer impacting events are judged internally trivial
- No record of the actions taken following the determination
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC7.2 Monitors system components for anomalies indicating malicious acts · CC7.4 Responds to identified security incidents through defined procedures