SOC 2 · A - Availability
SOC 2 SOC2-A1.2: A1.2 Environmental protection, backup and recovery infrastructure
SOC 2 SOC2-A1.2 covers A1.2 Environmental protection, backup and recovery infrastructure. The held text names 5 evidence records for it, the first being Backup policy defining scope, frequency and retention. The common gap an assessor flags is Backup failures not investigated.
Protection against environmental events, the supporting software, backup processes and recovery infrastructure are authorised, designed or acquired, implemented, operated, approved, maintained and monitored to meet objectives. Points of focus: environmental threats such as weather, failed environmental controls, electrical discharge, fire and water are identified in risk assessment; detection, protection mechanisms and alerts address them; response procedures, including automatic systems such as UPS and generators, are in place and evaluated; detected events are reviewed and acted on; data needing backup is determined; backups run with failure monitoring and correction; backups are stored far enough away that one event is unlikely to affect both copies; and alternate processing infrastructure can take over. The 2022 revision adds identifying threats to data recoverability, such as ransomware, and the measures that mitigate them, and notes that alternate processing can rely on geographically separate sites, redundant components and failover.
What evidence supports SOC2-A1.2?
- Backup and recoveryBackup policy defining scope, frequency and retention
- Backup and recoveryBackup job monitoring and failure remediation records
- Backup and recoveryEvidence of geographically separate or immutable backup copies
- Backup and recoveryData centre or cloud provider environmental controls (via their SOC report)
- Backup and recoveryFailover architecture documentation
Where this requirement comes from
This is our own statement of SOC 2 SOC2-A1.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Backup failures not investigated
- Backups reachable and deletable with the same credentials as production
- No alternate processing capability for critical services
How it maps to ISO 27001:2022
- 7.11 medium Environmental protections include supporting utilities, though utility failure testing is not required.
- 7.13 medium Maintaining and monitoring environmental and recovery infrastructure partially evidences equipment maintenance.
- 7.5 high Environmental protections designed, implemented, operated and monitored is protection against physical and environmental threats.
- 7.8 medium Environmental protection of infrastructure supports equipment siting without addressing placement decisions specifically.
- 8.13 high Data back up processes designed, implemented, operated and monitored is information backup.
- 8.14 high Recovery infrastructure implemented and maintained is redundancy of processing facilities.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.