CC7.5: Recovering from incidents

After an incident the company restores normal service, documents what happened, fixes the root cause and updates controls so it is less likely to recur.

Category: Security (common criteria, required in every SOC 2 report) · Series: CC7 (System operations) · TSC 2017 (2022 points of focus)

That summary is Policyseed’s own paraphrase, written to be read next to the policy sections below. The authoritative wording is the AICPA’s Trust Services Criteria, which the CPA firm tests your controls against during the examination.

Policies that address CC7.5

The Policyseed crosswalk points CC7.5 at 3 policies. Each link opens the full sample text at the section an auditor would read. Section 4 holds the statements management commits to; section 5 holds the procedures that produce evidence.

• P13 Incident Response Policy, section 5 (Procedures). Owner: Security Owner.
• P14 Business Continuity and Disaster Recovery Policy, section 5 (Procedures). Owner: Engineering Lead.
• P15 Backup and Recovery Policy, section 5 (Procedures). Owner: Engineering Lead.

Evidence examples for CC7.5

Artifacts a company of 5 to 200 people can realistically produce. The Audit Kit’s evidence checklist lists them per policy with an owner column so each one has a name against it before the examination.

• Post-mortem document for each significant incident with root cause and follow-up actions
• Remediation tracker entries created from post-mortem action items and their closure dates
• Backup restore test record used as part of incident recovery or recovery testing

Related criteria in CC7 (System operations)

• CC7.1: Detecting vulnerabilities and configuration changes
• CC7.2: Monitoring for anomalies
• CC7.3: Evaluating security events
• CC7.4: Responding to incidents

Previous: CC7.4 Responding to incidents. Next: CC8.1 Change management. All 38 criteria are listed on the template index.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.