Guide
SOC 2 availability: capacity, backup and recovery in scope
SOC 2 availability is one of the optional criteria beyond Security. So adding it tells customers that uptime commitments are backed by tested controls.
- Preparation, not the examination
- A licensed CPA firm signs the report
- Plain-English guidance
What SOC 2 availability covers
The availability criteria focus on keeping systems operating as committed. Also, they cover recovering when something fails.
| Area | Plain meaning |
|---|---|
| Capacity | Monitoring demand and planning for growth |
| Environmental protection | Infrastructure safeguards, backups and recovery setup |
| Recovery testing | Testing the recovery plan, not just writing it |
When to add SOC 2 availability to scope
Add it when customers depend on uptime. For example, a platform with contractual service levels. However, every extra criterion adds testing and cost.
Therefore ask customers what they actually need. Many accept a Security-only report at first.
SOC 2 availability readiness check
Tick what you can show today.
Your result appears here as you tick, so you can see what is still open.
Evidence for SOC 2 availability
The CPA firm will look for proof that plans were exercised. So a recovery test with results matters more than a long document.
- Capacity monitoring dashboards and alerts
- Backup configuration and restore tests
- Recovery plan and its last test
- Incident records for outages
Common gaps
Restore tests are often skipped. Because backups run silently, teams assume they work. Also, recovery plans name people who have left.
In addition, cloud provider reports cover their infrastructure only. Your own recovery remains yours.
Where Clearpoint helps
We help decide whether availability belongs in scope, then prepare the controls and evidence. Our preparation fee is fixed, between $5,000 and $40,000. We are not a CPA firm. The criteria are in the AICPA Trust Services Criteria.
Also set realistic commitments. Because the CPA firm tests against what you promise, an aggressive service level creates exceptions when reality falls short. So align contracts, status pages and the system description before the period starts. In addition, record every outage and its follow-up, because incident records show the controls responding. As a result, availability evidence reflects how the system really behaves, rather than how a brochure describes it.
SOC 2 availability questions
Is SOC 2 availability mandatory?
No. Only Security is required, while availability is optional.
Does SOC 2 availability require 99.9% uptime?
No. It tests your controls against your own commitments.
What evidence matters most for SOC 2 availability?
Tested recovery and restore records.
Does adding it raise the fee?
Usually, because the CPA firm tests more controls.
Related guides
Decide on SOC 2 availability scope
Tell us what customers asked for. We reply with a written scope and a fixed preparation fee. Also mention any service levels in your contracts, because they shape what the CPA firm tests. So the scope matches your real commitments, and the fee reflects them.
Scope your preparation