Frameworks · SOC 2 CC7.1

Continuous monitoring, on the record.

Drop scheduled campaigns into your Trust Services control catalog and let the locker accumulate evidence across the audit window. Share the read-only link directly with your auditor — no evidence-collection scramble at period end.

Criteria covered

6 mapped

Cadence

Weekly / continuous

Evidence retention

1 year

Auditor-tested

Big-4 SOC 2

Schedule campaigns → See the control map

Criteria covered

The CC7 series — tested and sealed.

Each row is a Trust Services criterion, the phase in the agent that produces evidence for it, and the artifacts your auditor receives.

Criterion

Phase

Artifacts

CC7.1

Detection of new vulnerabilities

Scheduled scans detect and evidence new exposures.

04 · vuln analysis

14 sealed

→

CC7.2

Monitoring for anomalies

Detector alerts triggered by agent traffic, captured.

02 · intelligence

4 sealed

→

CC7.3

Evaluation of security events

Confirmed findings triaged and severity-mapped.

05 · exploitation

11 sealed

→

CC7.4

Response to incidents

Re-runs after remediation to prove the fix landed.

06 + 07

5 sealed

→

CC7.5

Recovery from incidents

Post-remediation re-test evidence, signed and dated.

07 · reporting

3 sealed

→

CC4.1

Monitoring of controls

Weekly cadence proves controls operate over the window.

01 – 07

52 sealed

→

Phase → criterion mapping

Where each phase earns its evidence.

01 · Pre-engagement

Scheduled scope

Locks the recurring scope and consent for the audit window.

CC4.1

02 · Intelligence

Anomaly monitoring

Captures detector alerts triggered by scheduled traffic.

CC7.2

03 · Threat modeling

Surface tracking

Tracks changes to the exposed surface across windows.

CC4.1

04 · Vuln analysis

Vulnerability detection

The CC7.1 core — new exposures detected and evidenced.

CC7.1

05 · Exploitation

Event evaluation

Confirmed events triaged and severity-mapped.

CC7.3

06 · Post-exploitation

Response tested

Re-runs after remediation to prove the response landed.

CC7.4

07 · Reporting

Locker seal

sha-256 chain signed at seal time. Share-link ready.

CC7.5CC4.1

Stand up continuous evidence.

Schedule a weekly campaign. The locker accumulates control-mapped evidence across the window, and your auditor gets a read-only link — no period-end scramble.

Start a pilot → Talk to a SOC 2 specialist