The system is monitored to detect anomalies and security events

What an auditor asks for

An assessor checks that monitoring covered the in-scope systems and that a detected anomaly produced a recorded event.

• Monitoring coverage list
• Security event record

Evidence ShipReady collects for CC7.2

ShipReady maps CC7.2 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• CI/CD and source controlgithub-posture
• Application logsaudit-trail

Common gaps

• No artifact has been collected yet — ShipReady records the CC7.2 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).

Related controls

• CC7.1 — Vulnerabilities are detected and configuration changes are monitored
• CC7.3 — Security events are evaluated and incidents are responded to
• CC7.4 — An incident response plan defines containment, remediation, and communication steps
• CC7.5 — Recovery procedures are exercised after incidents and lessons feed back into the plan