Availability is about keeping the service usable as needed to meet its stated commitments and requirements. It is not a promise that the service will never go down.
When Availability is included in a SOC 2 examination, its additional criteria address three areas:
- Capacity: Monitor current use and plan for demand so the system can support the service.
- Protection and recovery: Maintain appropriate environmental protections, backups and recovery arrangements.
- Recovery testing: Test whether recovery procedures can meet the service’s objectives.
For example, a backup job marked successful does not show that the application can be restored and used in time. A recovery test helps check that next step.
The right controls depend on the service. A cloud-based team and a company running its own data center may divide responsibilities differently. Understand what your provider handles and what remains yours.
Keep commitments realistic and specific. The report should be read against the service and objectives it actually covers, not treated as a universal uptime guarantee.
Related: Choose the relevant Trust Services categories · SOC 2 guidance.
Source: AICPA Trust Services Criteria, Availability criteria A1.1–A1.3.
