FAQ: What is covered in the Availability criteria?

FAQ: What is covered in the Availability criteria?

The availability criteria addresses how you go about ensuring the in-scope data and systems stay online and recoverability should go awry.

Disaster recovery: An organization should have a plan in place to recover from a disaster or other catastrophic event that could impact the availability of its systems and data. This might include measures such as redundant systems, backup and recovery procedures, and testing to ensure that these measures are effective.
Maintenance: An organization should have a process in place for performing maintenance on its systems in a way that minimizes the impact on availability. This might include scheduling maintenance during off-peak hours, performing maintenance on a rolling basis to minimize disruption, and providing advance notice of planned maintenance to users.
Performance monitoring: An organization should have a system in place for monitoring the performance of its systems and data to ensure that they are available and functioning properly. This might include monitoring response times, error rates, and other performance metrics.
Capacity planning: An organization should have a process in place for ensuring that its systems and data have the capacity to meet the needs of its users. This might involve identifying future capacity needs and implementing measures to meet those needs, such as adding hardware or upgrading software.

Additional FAQs

What are the SOC 2 criteria?

The five SOC 2 criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy.

We have a SOC 2. How much effort is GDPR?

Assuming your Company is subject to GDPR, the level of effort depends a lot on the maturity of Organizational and Privacy controls. The Organizational will be mostly met by implementation

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.)

Are Representation Letters Required in SSAE 18?

Previously in SSAE-16 a Management Representation Letter was highly recommended and common practice, however, they were not explicitly required to be obtained except in certain existing subject matter sections. This

What are the costs of SOC 2?

There are a lot of factors that go into responding to this question. There are audit, consulting, software, internal resources, and other factors to consider which can easily grow from

What is SSAE 18 (formerly SSAE 16)?

A SOC 1 Type 1 report typically costs on average anywhere between $10,000 and $20,000 USD, without the readiness assessment project which most Organizations benefit from and can be an

Get Our Emails

SOC Reporting Guide