CC7.2: Monitoring for anomalies

Systems and logs are monitored for unusual activity that could indicate a security event, and alerts reach a person who is expected to act on them.

Category: Security (common criteria, required in every SOC 2 report) · Series: CC7 (System operations) · TSC 2017 (2022 points of focus)

That summary is Policyseed’s own paraphrase, written to be read next to the policy sections below. The authoritative wording is the AICPA’s Trust Services Criteria, which the CPA firm tests your controls against during the examination.

Policies that address CC7.2

The Policyseed crosswalk points CC7.2 at 2 policies. Each link opens the full sample text at the section an auditor would read. Section 4 holds the statements management commits to; section 5 holds the procedures that produce evidence.

P12 Logging and Monitoring Policy, sections 4 (Policy Statements) and 5 (Procedures). Owner: Engineering Lead.
P13 Incident Response Policy, section 4 (Policy Statements). Owner: Security Owner.

Evidence examples for CC7.2

Artifacts a company of 5 to 200 people can realistically produce. The Audit Kit’s evidence checklist lists them per policy with an owner column so each one has a name against it before the examination.

Logging tool alert rules export (for example Datadog monitors) covering authentication failures, privilege changes and production errors
Sample alert notification with timestamp and the on-call response
Centralized logging dashboard screenshot showing production log sources
On-call rotation schedule or escalation configuration

Related criteria in CC7 (System operations)

Previous: CC7.1 Detecting vulnerabilities and configuration changes. Next: CC7.3 Evaluating security events. All 38 criteria are listed on the template index.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.