Security events are evaluated and incidents are responded to

What an auditor asks for

An assessor samples security events and checks that someone decided whether each one was an incident and what was done next.

• Event triage record
• Incident ticket

Evidence ShipReady collects for CC7.3

ShipReady maps CC7.3 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Connected systemjsm-incident
• Connected systemincident-response

Common gaps

• No artifact has been collected yet — ShipReady records the CC7.3 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC7.1 — Vulnerabilities are detected and configuration changes are monitored
• CC7.2 — The system is monitored to detect anomalies and security events
• CC7.4 — An incident response plan defines containment, remediation, and communication steps
• CC7.5 — Recovery procedures are exercised after incidents and lessons feed back into the plan