Incident response is the process of evaluating security events, addressing security incidents, and restoring affected systems. In a SOC 2 examination, an independent auditor evaluates incident response controls against CC7 of the AICPA Trust Services Criteria. The auditor examines detection methods, event classification, response activities, communication, and recovery evidence.
Incident response involves more than a document that an auditor reads once. It includes control activities that an auditor inspects, samples, and, where appropriate, re-performs to evaluate how a service organization handles security events.
A written plan may describe assigned roles and escalation procedures. Examination evidence must also support management's account of how the organization identifies events, determines their significance, responds to incidents, and restores operations. The auditor evaluates these activities against the applicable Trust Services Criteria, with particular attention to CC7.
This article explains what the SOC 2 examination evaluates, how the auditor tests incident response evidence, and how exceptions may affect the report.
Concern
Management may assume a written incident response plan satisfies CC7. The auditor also evaluates whether the organization detected events, classified their significance, contained incidents, communicated relevant information, and completed recovery activities. Dated records help establish how each activity occurred and who performed it.
Overview
CC7 is the AICPA Trust Services Criteria cluster governing system monitoring and incident response. CC7.1 through CC7.5 address detection, event evaluation, incident response, and recovery. A Type 1 examination evaluates control design and implementation at a specified date. A Type 2 examination also tests operating effectiveness over a defined period. The auditor selects procedures based on the examination scope and assesses risks.
Solution
Organizations should treat every incident response process touchpoint as an audit artifact, and maintain time-stamped tickets, severity classifications, containment records, notification logs, and written post-incident reviews. The examination results, including any exceptions, inform the auditor's opinion on the applicable criteria.
SOC 2 Incident Response: How Auditors Scope CC7 Controls
The auditor begins by identifying the controls that address security events and incidents within the system under examination. The AICPA Trust Services Criteria provide the basis for evaluating these controls. CC7 focuses on system operations, including detection, investigation, response, and recovery.
CC7.1 to CC7.5: What Auditors Examine
-
CC7.1: Configuration and vulnerability detection
The auditor evaluates configuration records showing monitoring tools are active, alert threshold documentation, and logs demonstrating alerts are being generated.
-
CC7.2: Anomaly monitoring
The auditor examines monitoring activities that identify unusual system activity, potential security events, and whether a severity classification scheme was actually applied to sampled events.
-
CC7.3: Event evaluation
The auditor evaluates how personnel assess security events and determine whether they could affect the organization's objectives. CC7.3 requires documented response actions.
-
CC7.4: Incident response
The auditor inspects how the organization understands, contains, remediates, and communicates identified security incidents.
-
CC7.5: Recovery
The auditor evaluates restoration activities, root cause analysis, and changes intended to address recurrence.
These criteria work together, but they address distinct control activities. The auditor evaluates each applicable control in relation to the system, risks, and examination scope.
How Auditors Distinguish a Security Event from an Incident
CC7.3 addresses the evaluation of security events. An alert, failed login, or unusual network connection may warrant investigation without qualifying as a security incident.
The auditor inspects the organization's classification criteria and examines selected events that management closed as non-incidents. The auditor evaluates whether records support those decisions. For example, an alert closure may include investigation notes, relevant log entries, and the reason for dismissing the alert. A classification decision without supporting evidence may raise questions about the control's operation.
CC7 belongs to the Common Criteria for the Security category. The auditor evaluates incident response controls against the criteria relevant to the selected categories and the system's commitments.
SOC 2 Incident Response Plan: What Auditors Inspect for Design
The incident response plan provides evidence of management's intended approach. The auditor evaluates whether the documented activities address the risks and responsibilities relevant to CC7.4. The examination also considers whether the organization has implemented the described controls.
Plan Components Mapped to CC7.4
The auditor inspects how the plan assigns responsibility for incident response and addresses containment, remediation, communication, and recovery. The auditor considers whether personnel can identify their roles and whether escalation procedures support timely decisions.
For example, a plan may assign incident leadership to a security manager and define when technical teams isolate affected systems. The auditor examines these provisions alongside approval records, role assignments, and relevant procedures. A written plan supports the design evaluation, but its contents alone do not establish operating effectiveness.
Design Evidence
A Type 1 examination evaluates whether controls were suitably designed and implemented at a specified date. The auditor uses inquiry with the incident lead, inspection of the approved plan and related records, and walkthroughs of relevant procedures.
For a Type 2 examination, the auditor also evaluates operating effectiveness over the examination period.
Communication Protocols and Third-Party Roles
CC2.3 addresses communication with external parties about matters affecting the functioning of internal control. CC7.4 addresses communication about security incidents and response actions as appropriate. The auditor evaluates which communication activities apply to the organization's circumstances.
Evidence may include escalation records, incident notifications, customer communications, and agreements that assign response duties to external service providers. The Trust Services Criteria do not prescribe a particular cyber insurance product as a condition of satisfying CC7.
CC7 Sub-Criteria: Auditor Evidence Requirements at a Glance
-
CC7.1
Auditor's focus: Configuration and vulnerability detection
Illustrative evidence: Configuration monitoring records, vulnerability scan results, remediation tracking
-
CC7.2
Auditor's focus: Anomaly detection and security event identification
Illustrative evidence: Monitoring alerts, SIEM records, anomaly investigation logs
-
CC7.3
Auditor's focus: Event evaluation and incident determination
Illustrative evidence: Event investigation records, classification rationale, escalation decisions
-
CC7.4
Auditor's focus: Incident response and communication
Illustrative evidence: Containment records, remediation tickets, incident notifications
-
CC7.5
Auditor's focus: Recovery and recurrence prevention
Illustrative evidence: Restoration test results, recovery records, root cause analysis, corrective changes
Incident Response Process: How Auditors Test Operating Effectiveness
For a Type 2 examination, the auditor evaluates whether the incident response process operated effectively during the specified period. This requires evidence of actual control activities, not just documented procedures. The auditor selects testing procedures based on the control, assessed risk, and available evidence.
Population and Sample Selection
The auditor requests the population of relevant security events and incidents for the examination period. Sources may include security information and event management systems, incident tickets, monitoring alerts, and service desk records.
The auditor evaluates whether the population is complete and accurate for the intended testing purpose. The auditor then selects items for testing based on the examination approach and applicable sampling considerations.
For each selected item, the auditor examines records that support the relevant control activities. These may include the initial detection timestamp, event classification, severity assessment, assigned owner, containment action, communication, root cause analysis, and closure approval.
Testing Controls When No Incidents Occur
An empty incident population may not point to a control deficiency. The auditor evaluates whether the organization's monitoring and response controls operated as intended, even when management reports no security incidents.
Procedures may include inquiry about monitoring operations, inspection of tabletop exercises or recovery test records, observation of monitoring activities, and reperformance of selected detection procedures where appropriate. The auditor determines which procedures provide relevant evidence for the control under examination.
Incident Response Framework: How Auditors Evaluate Reporting and Opinion Impact
A service organization may adopt a named incident response framework to define roles, escalation, investigation, and recovery. The Trust Services Criteria do not prescribe one particular framework for every organization. A framework is not the criteria. If management uses a framework as part of its control design, the auditor may consider its relevant provisions when evaluating the controls.
Incident Disclosure in the System Description
The AICPA description criteria address the nature, timing, and consequence of relevant incidents. The auditor evaluates whether management's description meets the applicable disclosure criteria and whether the information aligns with the examination evidence. The auditor considers the incident's significance, the affected commitments, and the effect on the system.
The description criteria address reporting in the system description, while CC7 addresses the underlying control activities.
Exceptions and Opinion Consequences
An exception occurs when testing identifies a difference between the expected control activity and the evidence of its operation. The auditor evaluates the nature and significance of the exception and considers whether it indicates a control deficiency that affects the applicable criteria.
For example, an incident ticket may lack evidence of a required containment action. The auditor may inspect related logs, interview responsible personnel, and evaluate other evidence before reaching a conclusion. A qualified opinion may result when the auditor concludes that a material matter prevents an unqualified opinion, subject to the applicable reporting requirements.
Conclusion
SOC 2 auditors at CertPro approach incident response not as a policy review but as an evidence reconstruction exercise. For each CC7 sub-criterion, they require a traceable, time-stamped record that links detection through classification, containment, notification, and post-incident review. An incident response process that functions operationally but leaves no auditable artifacts may produce findings regardless of how well the underlying policy is written.
Discuss Your SOC 2 Examination With CertPro's Independent Auditors
CertPro is an independent, licensed CPA firm that performs SOC 2 examinations and issues attestation reports. Schedule a meeting with our auditors to discuss examination scope, the examination period, and the evidence the CC7 criteria require.
