Criterion CC7.4The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.

The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.

SOC 2, the trust services criteria, CC7.4

Criterion text: 2017 Trust Services Criteria (with revised points of focus, 2022). © 2022 Association of International Certified Professional Accountants. All rights reserved. COSO principles © 2019 Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Reproduced from copies of AICPA's published text; check it against AICPA's own before relying on it.