An incident response plan defines containment, remediation, and communication steps

What an auditor asks for

An assessor reads the incident plan and checks that it names who contains an incident, who fixes it, and who is told.

• Incident response plan
• Contact roster

Evidence ShipReady collects for CC7.4

ShipReady maps CC7.4 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Connected systemjsm-incident

Common gaps

• No artifact has been collected yet — ShipReady records the CC7.4 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC7.1 — Vulnerabilities are detected and configuration changes are monitored
• CC7.2 — The system is monitored to detect anomalies and security events
• CC7.3 — Security events are evaluated and incidents are responded to
• CC7.5 — Recovery procedures are exercised after incidents and lessons feed back into the plan