SOC 2 Vulnerability Scanning Requirements

Vulnerability scanning for SOC 2

SOC 2 does not say the words vulnerability scan, but every auditor asks for one. Criterion CC7.1 expects you to detect new vulnerabilities on a regular basis, and the easiest evidence is a scanner that runs on a schedule and keeps its reports. This page explains what the criterion asks for, what the auditor wants to see, and how to have scanning running before your audit window opens.

What SOC 2 actually says

The Trust Services Criteria address vulnerability management in CC7.1, which asks the entity to use detection and monitoring procedures to identify changes to configurations that result in new vulnerabilities, and to identify susceptibilities to newly discovered vulnerabilities. Auditors read that as routine vulnerability scanning of in-scope systems, internal and external, with findings tracked to closure. Monthly or quarterly scans are the common expectation, and a scan after major changes.

What your auditor needs to see

Scan reports covering every in-scope system for the whole audit period.
A regular cadence, with dates.
Findings rated by severity and tracked to a fix or an accepted exception.
Rescan evidence showing the fix worked.
Both external (internet-facing) and internal (servers and workstations) coverage when both are in scope.

Getting it done this week

Clone Systems external vulnerability scanning covers your internet-facing systems and is ready the moment you check out. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. Add internal vulnerability scanning for your servers, office network and cloud hosts. Internal scanning is $1,095 a year for 128 IPs, $1,495 for 512, $2,295 for 2,048. Every package includes free rescans, and reports export mapped to SOC 2 from the portal.

Why Clone Systems

PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.

Buy vulnerability scanning · Talk to our scanning team

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.