If a customer wants availability in our SOC 2 report, what must we show about recovery?

Start

A customer asks for availability in our SOC 2 report

A SOC 2 report is an independent CPA firm's opinion on management's description of a system and its controls. It is not a certificate. Availability is an optional category, so the first question is whether you need it. What you can show about recovery then depends on what you have committed to and what you have tested.

• Then: Gather the customer's request, the contracts and the service levels

Step

Gather the customer's request, the contracts and the service levels

Collect the customer requests and contracts that mention SOC 2, the service levels and other written commitments you make, the providers that run parts of the service, and the date each customer needs the report. Legal reads the contracts. The examination owner owns the assessment.

• Then: Does a customer or contract need it, or have we committed in writing?

Decision

Does a customer or contract need it, or have we committed in writing?

The pack's rule is to add Availability only where a customer or a written commitment needs it, because each category adds criteria and evidence. A contract service level, such as a monthly availability figure, is its example of a reason. If you cannot tell, answer yes and ask Legal.

• Yes, or not known: Add the Availability category and list its three criteria
• No: Leave Availability out and revisit if a commitment changes

Outcome

Leave Availability out and revisit if a commitment changes

Security stays in scope by default. Revisit the scope when the service, the boundary, a major provider or a customer commitment changes, and before each new period, and write down why the scope is what it is.

Step

Add the Availability category and list its three criteria

Availability has three criteria: A1.1, A1.2 and A1.3, each titled Additional Criteria for Availability. The CISO Times Library shows each criterion's full text under SOC 2. Also read CC9.1, Risk Mitigation, one of the Security criteria that almost every report covers. Mark each in your own register with your controls, an owner and the evidence each control leaves. Whether your controls answer them is for the CPA firm.

• Then: Does each service in scope have agreed recovery objectives?

Decision

Does each service in scope have agreed recovery objectives?

The commitment you made to the customer has to rest on something. In the pack each critical service has a recovery time objective shorter than its maximum tolerable downtime, and a recovery point objective, agreed by its business owner from a business impact analysis. If the figures were set by IT alone, they are not agreed, so answer no.

• Yes: Does a provider run a system the service depends on?
• No, or not known: Agree objectives with each owner, then compare with the contract

Step

Agree objectives with each owner, then compare with the contract

Run the business impact analysis with the business owner, process by process. Then compare the objectives with what the contract promises. If the objectives cannot keep a written commitment, that is for you to settle with Legal and the customer. The pack is silent on how.

• Then: Does a provider run a system the service depends on?

Decision

Does a provider run a system the service depends on?

Where a provider runs the system, the pack's test is the provider's own recovery test, with its results shared and checked against your objectives. In the SOC 2 scope you decide a carve-out or an inclusive method for each provider that matters to the criteria. If you do not know which providers matter, answer yes.

• Yes, or not known: Get the provider's recovery test and its SOC 2 report
• No: Was each service's recovery tested and reported inside the period?

Step

Get the provider's recovery test and its SOC 2 report

Ask each provider for its own SOC 2 report, or find out why it has none. A carve-out leaves a list of controls you assume the provider operates and a duty to watch that it does. A supplier's recovery time is what its contract gives, or unknown, until it shares a test.

• Then: Was each service's recovery tested and reported inside the period?

Decision

Was each service's recovery tested and reported inside the period?

A Type 1 report covers the design of controls on one date. A Type 2 report covers design and operation throughout a period, the observation period, and the CPA firm tests the operation. The pack's default is a recovery test at least every 12 months, and each record carries a date inside the period. Each test has a plan the business owner approves and a report with the time achieved and the data lost. In this pack a tabletop is not a recovery test. If you cannot say, answer no.

• Yes: Did the test meet its recovery time and data-loss objectives?
• No, or not known: Book the test in the period, with a plan, a stop point and a way back

Step

Book the test in the period, with a plan, a stop point and a way back

Plan the test so it does not cause the outage it rehearses: a copy or a quiet period, a stop point, a way back, and one role who may stop it. The business owner approves the plan first. The pack's default is a report within 10 working days. A record counts only if it is dated inside the period.

• Then: Did the test meet its recovery time and data-loss objectives?

Decision

Did the test meet its recovery time and data-loss objectives?

Read both from logs. A missed objective is an objective gap with an owner and a due date, and the service's risk owner is told. Every finding goes in the report, a miss included. If the measure was not taken, answer no.

• Yes: Were backups restored and checked by someone other than the tester?
• No, or not known: Raise the gap and agree the fix, then keep the finding in the report

Step

Raise the gap and agree the fix, then keep the finding in the report

The pack's default is that the owner agrees the change that closes the gap within 10 working days, with a due date. Write the lessons into the service's recovery plan. Say plainly in the report what the test did not show, because a report that claims no limits is one a careful reader will doubt.

• Then: Were backups restored and checked by someone other than the tester?

Decision

Were backups restored and checked by someone other than the tester?

A finished backup job shows only that the job wrote something. The pack counts a restore test only if the restore completed, the copy and the restored data passed integrity checks, the time and data lost were within the objectives where timed, the result was checked by someone other than the tester with the data owner, and the evidence is recorded. If not known, answer no.

• Yes: Does each record show a date in the period, a person, and its source?
• No, or not known: Run a restore test and judge it against the six pass criteria

Step

Run a restore test and judge it against the six pass criteria

Choose the restore type for each system from the pack's five. Restore a copy from an immutable or offline source to an isolated place, never onto production. The test passes only if all six hold: restore completed, integrity checks passed, time within the recovery time objective, data lost within the recovery point objective, result checked by someone other than the tester, evidence recorded. The two objective checks apply to timed tests only. A restore in normal conditions does not show the cyber recovery time, and the report says so.

• Then: Does each record show a date in the period, a person, and its source?

Decision

Does each record show a date in the period, a person, and its source?

The pack tests every record four ways: it is dated inside the period, it shows who did the work, it can be found in minutes by someone who was not there, and it comes from the system that holds the work. Evidence made up afterwards is not evidence (SR-09). Where any test fails, the answer is no.

• Yes: Show the objectives, test reports, restore evidence and dated records
• No, or not known: Fix how the record is made, then check again before the period

Outcome

Fix how the record is made, then check again before the period

A failed evidence test is a finding to fix at source: record it, give it an owner and a date, and change the way the record is made. A record dated when it was copied out is not dated. Settle this before the readiness assessment rather than after the period starts.

Outcome

Show the objectives, test reports, restore evidence and dated records

What the pack shows you can hold: agreed objectives, approved test plans and reports against them, restore evidence with the checks, the gaps and their owners, and dated records from the systems of record. The CPA firm forms the opinion on the availability criteria, and nothing here says what it will conclude or that you will receive a particular opinion.