Frameworks · Global
SOC 2 Availability
The Availability category is an optional SOC 2 add-on to the Security criteria that covers keeping systems up and usable as promised to customers. It looks at capacity planning, environmental protections, backups and tested recovery plans. Include it when customers depend on your uptime or you make service level commitments.
- Version
- 2017 Trust Services Criteria (revised points of focus 2022)
- Requirements
- 4, each mapped to ProofTrail’s controls
Requirements and controls
-
A1 Additional Criteria for Availability
-
A1.1 Capacity monitoring and planning
Current capacity and usage of infrastructure, data and software are monitored and forecast so capacity can be added before availability commitments are at risk.
- Capacity & Performance Management
-
A1.2 Environmental protection, backup and recovery infrastructure
Environmental safeguards, backup processes and recovery infrastructure are put in place, monitored and maintained so systems stay available or can be restored.
- Disaster Recovery Policy
- Business Continuity Policy & Procedure
- Data Backup Policy
- Data Backups
- Backup Restoration Testing
-
A1.3 Recovery plan testing
Backup restores and business continuity or disaster recovery plans are tested regularly to confirm systems can actually be recovered.
- Disaster Recovery Policy
- Business Continuity Policy & Procedure
- Backup Restoration Testing
- Disaster Recovery Testing
-