Skip to content

SOC 2® availability criteria in plain English (A1.1 to A1.3)

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at the SOC 2 availability criteria, A1.1 to A1.3: capacity, backups and resilience, and whether you have tested a restore.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

Can customers count on your service being up, and could you rebuild it?

Availability is an optional category. Companies add it when customers need commitments about uptime or recovery. Its three criteria have everyday engineering meanings: do you have enough capacity, do you have backups and resilience, and have you tried restoring.

Whether to include it is a scoping decision between you, your customers, and the CPA firm. It matters most when you have put uptime numbers into contracts or onto a status page.

Where a small team starts

Write your recovery targets down: how long you can be down, and how much data you can afford to lose. Then restore your latest backup into a scratch environment and time it.

Written targets and one recorded restore are the cheapest honest start. If the restore is slower than your targets, you have learned something a document alone could never tell you.

The criteria, A1.1 to A1.3

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

A1.1: Enough capacity, before you need it

The company watches how much compute, storage, and network it uses and adds more before demand outruns it.

In practice

  • Dashboards on CPU, memory, disk, and database connections, with alerts at set thresholds.
  • Autoscaling, or a quarterly capacity review with notes.
  • A load test before a big launch.

A1.2: Backups and protection from disaster

The company protects against environmental hazards and keeps backups and spare capacity so it can recover. Many small teams inherit the physical side from their cloud provider and own the backups and settings themselves.

In practice

  • Automated daily database backups with a stated retention period.
  • Deployment across more than one zone, so one failure doesn’t take the service down.
  • Backups stored in a separate account or region from the live data.
  • A note of what the hosting provider covers, with a pointer to its own report.

A1.3: Testing recovery for real

Recovery plans get exercised, not just written. The test shows whether backups restore and how long recovery takes.

In practice

  • A quarterly restore of a backup into a scratch environment, with the time noted.
  • A yearly failover exercise or tabletop, with notes.
  • Recovery targets written down and compared with what the tests measured.
  • Fixes from each test tracked to done.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • What is your uptime commitment, and how do you measure it?
  • When was the last restore test, and how long did it take?
  • Where do backups live, and who can delete them?
  • How would you know you were running out of capacity?
  • What happens if your main region fails?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides