SOC 2 CC7.3: System Operations - Evaluation of Security Events

Build a security event classification framework. Define clear criteria for separating security events (any observable occurrence relevant to security) from security incidents (events that actually or potentially compromise confidentiality, integrity, or availability).

Set up severity levels for incidents. A practical model: Critical (significant breach or compromise with immediate business impact), High (confirmed incident with potential for significant impact), Medium (incident with limited scope), Low (minor event without significant operational impact). Give specific criteria and examples for each level.

Define your triage process. When a security event comes in, who does the initial assessment? What information gets gathered? What tools are used? What are the decision criteria for escalation versus closure? Document triage decisions with rationale.

Map out escalation procedures by severity. Critical events should trigger immediate incident response team activation and executive notification. High events go to the security team lead. Medium and low events flow through normal operational channels. Add time-based escalation for events that sit untriaged beyond defined windows.

Train your security operations team on the evaluation process. Cover common attack patterns, indicators of compromise, forensic analysis basics, and your specific classification criteria. Run tabletop exercises that practise evaluation and escalation decisions.

Keep records of every security event evaluated: the initial alert, investigation performed, classification decision, rationale, and resulting action. Use these for trend analysis, process improvement, and audit evidence. Review the evaluation process periodically for consistency.