← SOC 2 Trust Services Criteria in plain English

CC7.1 CC7

System Operations / CC7.1

Detecting configuration drift and new vulnerabilities

Think of it likeNoticing that a window has been left open, and that the frame has rotted.

In plain English

The organization monitors for changes to configuration that introduce risk, and scans for newly disclosed vulnerabilities, against a defined baseline of how systems are supposed to be set up.

Related CSF, CIS and ISO controls (unofficial mapping)