SOC 2 A1.2: recovery infrastructure, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For A1.2, the usual records are these.

• Backup configuration and job history
• Multi-zone or redundant deployment settings
• Your cloud provider's SOC 2 report

What Polara asks about it

The free readiness assessment asks 5 questions that bear on A1.2. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Databases and volumes backed up? If yes, show it: AWS Relational Database Service (RDS) automated backup settings, S3 bucket for backups, backup job schedule, or backup success logs. If no, the fix: enable automated backups for databases and volumes and export the backup configuration.
• Multi-region or multi-zone recovery strategy? If yes, show it: DR architecture diagram, AWS multi-region setup, failover runbook, or DR environment inventory. If no, the fix: define a recovery strategy across zones or regions and document the recovery objectives.
• Have you set a recovery time objective and a recovery point objective for production, and has management approved them? If yes, show it: business continuity plan page stating the recovery time and recovery point objectives with its approval, an approval email or meeting minutes, or a service level document naming both objectives. If no, the fix: set a recovery time objective and a recovery point objective for production, have management approve them, and record them in the business continuity plan.
• If one availability zone or data center fails, does production keep running or fail over without a rebuild? If yes, show it: database console showing multi-zone deployment, an auto scaling group or cluster spanning zones, a load balancer with targets in more than one zone, or an architecture diagram marked with zones. If no, the fix: run production databases, compute and load balancers across at least two availability zones, or keep a tested standby, and export the configuration.

It also asks, for context:

• Backup frequency.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Business Continuity and Disaster Recovery Policy covers A1.2. Availability adds no policy of its own; its criteria are written into that policy.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Backup and restore test log template

If you also run ISO 27001, the Annex A controls A.7.5, environmental threats, A.7.8, placing equipment safely, A.7.11, power and utilities, A.7.13, equipment maintenance, A.8.13, backups and A.8.14, redundancy ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is backup & Recovery. The fix: configure automated backups for all production data stores. The proof: screenshot of backup configuration showing schedule, retention, and encryption status.

An auditor asks two things about it. Is there a documented backup and recovery strategy? Are automated backups configured and running for production data?

Is it in your scope?

Only if you add Availability. Whether the service stays up as promised. Capacity, backups, redundancy and tested recovery. It belongs in scope when customers rely on an uptime commitment in your contracts.

The scoping tool decides it with one question: Add it when your contracts promise uptime, such as a 99.9 percent service level, or customers cannot run their own business while you are down. Recovery objectives, redundancy across zones or data centers, capacity monitoring, backups and recovery testing.

Security is the default and always in scope. Adding Availability in the assessment puts its 3 criteria into the report and the examination, and adds 3 questions to the assessment.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Availability: the criteria around it

A1.2 is one of 3 criteria in availability, A1.1 to A1.3. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• A1.1, capacity planning
• A1.2, this page
• A1.3, recovery testing

Before it: A1.1, capacity planning. After it: A1.3, recovery testing. All the criteria, Security first, are on the Trust Services Criteria page, grouped by category.