A1.2 Environmental protection, backup and recovery infrastructure

Protection against environmental events, the supporting software, backup processes and recovery infrastructure are authorised, designed or acquired, implemented, operated, approved, maintained and monitored to meet objectives. Points of focus: environmental threats such as weather, failed environmental controls, electrical discharge, fire and water are identified in risk assessment; detection, protection mechanisms and alerts address them; response procedures, including automatic systems such as UPS and generators, are in place and evaluated; detected events are reviewed and acted on; data needing backup is determined; backups run with failure monitoring and correction; backups are stored far enough away that one event is unlikely to affect both copies; and alternate processing infrastructure can take over. The 2022 revision adds identifying threats to data recoverability, such as ransomware, and the measures that mitigate them, and notes that alternate processing can rely on geographically separate sites, redundant components and failover.

Source: SOC 2 (2017 Trust Services Criteria), A1.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.