SOC 2 CC9.1: disruption risk, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC9.1, the usual records are these.

• A business continuity and disaster recovery plan
• Recovery time and recovery point objectives
• Restore test records

What Polara asks about it

The free readiness assessment asks 3 questions that bear on CC9.1. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Databases and volumes backed up? If yes, show it: AWS Relational Database Service (RDS) automated backup settings, S3 bucket for backups, backup job schedule, or backup success logs. If no, the fix: enable automated backups for databases and volumes and export the backup configuration.
• Multi-region or multi-zone recovery strategy? If yes, show it: DR architecture diagram, AWS multi-region setup, failover runbook, or DR environment inventory. If no, the fix: define a recovery strategy across zones or regions and document the recovery objectives.
• DR/BCP tested at least annually? If yes, show it: disaster recovery test results report, tabletop exercise notes, recovery time and recovery point test summary, or remediation task list. If no, the fix: run a disaster recovery test at least annually and retain the test record and lessons learned.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Business Continuity and Disaster Recovery Policy covers CC9.1.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Business continuity plan template
• Risk register template

If you also run ISO 27001, the Annex A control A.5.29, security during a disruption ask for overlapping evidence. One record can serve both when it names what it proves.

Is it in your scope?

Yes, always. CC9.1 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Risk mitigation: the criteria around it

CC9.1 is one of 2 criteria in risk mitigation, CC9.1 to CC9.2. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC9.1, this page
• CC9.2, vendor risk

Before it: CC8.1, change management. After it: CC9.2, vendor risk. All the criteria are on the Trust Services Criteria page, grouped by category.