Recovery procedures are exercised after incidents and lessons feed back into the plan

What an auditor asks for

An assessor looks for a recovery exercise or a real incident and checks that lessons were written back into the plan.

• Recovery exercise record
• Updated incident plan

Evidence ShipReady collects for CC7.5

ShipReady maps CC7.5 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Connected systemjsm-incident
• Connected systemincident-response

Common gaps

• No artifact has been collected yet — ShipReady records the CC7.5 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting record exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC7.1 — Vulnerabilities are detected and configuration changes are monitored
• CC7.2 — The system is monitored to detect anomalies and security events
• CC7.3 — Security events are evaluated and incidents are responded to
• CC7.4 — An incident response plan defines containment, remediation, and communication steps