CC7.4 Responding to security incidents

Identified security incidents are handled through a defined response programme that understands, contains, remediates and communicates them as appropriate. Points of focus: roles for designing, running and maintaining the programme are assigned, including outside help; incidents are contained, their ongoing effects mitigated and their threats ended by closing vulnerabilities and removing unauthorised access; operations and data are restored to an interim workable state; communication protocols reach affected parties; the nature and severity of each incident drive the response time frame and containment approach; vulnerabilities are remediated and the remediation documented and communicated; the design of the response is evaluated periodically; incidents are reviewed for patterns and root causes that call for system change; and in privacy engagements, unauthorised use or disclosure is reported to data subjects, authorities and others as required, and those responsible are sanctioned where appropriate. The 2022 revision frames remediation as resolving the identified vulnerabilities and, for privacy engagements, adds applying defined breach response procedures once a privacy incident is confirmed.

Source: SOC 2 (2017 Trust Services Criteria), CC7.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.