SOC 2 and backup testing.
If your SOC 2 examination includes Availability, backups and recovery tests have an explicit role. RestoreTrust documents the relevant test runs for your evidence records.
In the Availability category, the AICPA Trust Services Criteria cover backup processes and recovery infrastructure under A1.2. A1.3 calls for testing recovery procedures. These additional criteria apply when Availability is part of the agreed examination scope.
What the tests cover
The supporting guidance for A1.3, known as Points of Focus, includes regular testing of contingency plans and checks on backup integrity and completeness. These points help assess a control. Agree which tests and evidence suit your systems as part of your SOC 2 examination.
Document tests throughout the review period
RestoreTrust runs restore tests on your schedule and records the results of your checks. This lets you review test runs across the agreed period. For a Type II examination, these ongoing records help assess the effectiveness of your controls.
How RestoreTrust helps
- Recurring tests throughout your review period
- Documented restores and check results
- PDF reports, where included in your plan
How to put the tests into practice
- Map tests to the agreed controls
- Define check criteria for your data
- Agree the evidence with your auditor
Part of your SOC 2 evidence
RestoreTrust documents the part of your controls that covers restoring and checking your backups. These results complement your other evidence. Together, they form the basis for an independent assessment of your controls within the agreed SOC 2 scope.