A1.3 Testing recovery plan procedures

Procedures in the recovery plan that support system recovery are tested to confirm objectives can be met. Points of focus: business continuity plan testing is performed periodically, with scenarios weighted by how likely and how severe threats are, components across the organisation and its vendors that can impair availability, and unavailability of key people or vendors (vendors added in 2022), and plans are revised from the results; and backup data is tested periodically for integrity and completeness.

Source: SOC 2 (2017 Trust Services Criteria), A1.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.