CC7.1 asks how you find new vulnerabilities and risky changes. For a Type 2 report you have to show it happened across the whole period, not just the week before fieldwork. MopokeHQ records every match, deadline and deployed fix as it happens, then exports the period your auditor asks for.
CC7.1 is one of the common criteria in the AICPA Trust Services Criteria. It asks you to use detection and monitoring to find configuration changes that introduce new vulnerabilities, and your exposure to newly discovered ones.
Its points of focus guide your auditor. They are not a checklist, and your auditor decides what evidence meets the criterion.
Where MopokeHQ’s records fit, and where they stop.
| Point of focus | MopokeHQ evidence | Fit |
|---|---|---|
| Vulnerability scans, periodically and after significant change, with timely remediation | Scans in every pipeline. Every stored SBOM re-matched when a new advisory lands. External scans on a schedule. Each finding has a deadline and closes only when the fix is seen deployed. | Main fit |
| Detects unknown or unauthorised components | Every build’s SBOM lists every package and version. The supply chain proxy add-on blocks known-malicious packages and flags typosquats and brand-new packages. | Software components only |
| Monitors infrastructure and software | Container image and infrastructure as code scanning, external TLS, port and template checks on verified targets | Partial |
| Change-detection mechanisms | Merge request gates on new findings. Deployment reports show what changed in each environment. | Not file integrity monitoring |
| Defined configuration standards | Infrastructure as code scan results | Your standard is your own document |
A Type 2 report looks at whether controls operated over a period. Pick SOC 2 and your audit window and MopokeHQ produces the pack for exactly those dates. The JSON copy carries the chain hashes, so a changed or removed entry would show.
Every merge request pipeline runs the scanners. The gate fails only on new findings, so existing debt goes on the roadmap instead of blocking every merge.
GitLab merge request gatesA common criterion in the AICPA Trust Services Criteria. It asks you to use detection and monitoring to find configuration changes that introduce vulnerabilities, and newly discovered vulnerabilities that affect you.
CC7.1 lists vulnerability scans as a point of focus: run periodically and after significant changes, with timely remediation. Points of focus guide the auditor rather than mandate a method, but scanning is the usual way to meet CC7.1.
No. SOC 2 is an attestation report from an independent CPA firm. Type 1 looks at control design at a point in time. Type 2 looks at whether controls operated over a period.
Usually proof that scans ran across the period, that findings were prioritised, and that they were fixed within your own timeframes. MopokeHQ’s evidence pack covers those for the software you ship.
No. Customers ask for it, usually during procurement.
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.