Vulnerabilities are detected and configuration changes are monitored

What an auditor asks for

An assessor checks that vulnerability scans and configuration checks ran in the period and that new findings were recorded.

• Vulnerability scan
• Configuration change log

Evidence ShipReady collects for CC7.1

ShipReady maps CC7.1 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Connected systemconnector-health
• Configuration exportsecurity-scan
• CI/CD and source controliac-scan
• CI/CD and source controlgithub-posture
• Configuration exportaws-posture
• Configuration exportazure-posture
• Configuration exportgcp-posture
• Connected systemvulnerability-management

Common gaps

• No artifact has been collected yet — ShipReady records the CC7.1 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC7.2 — The system is monitored to detect anomalies and security events
• CC7.3 — Security events are evaluated and incidents are responded to
• CC7.4 — An incident response plan defines containment, remediation, and communication steps
• CC7.5 — Recovery procedures are exercised after incidents and lessons feed back into the plan