SOC 2 disaster recovery testing examines whether an entity can meet its recovery commitments and support those results with dated evidence. The CPA evaluates A1.2 and A1.3 when management includes Availability in scope, alongside CC7.5 and CC9.1. The entity’s control commitments set the examination criteria. Disaster recovery testing must produce evidence that supports those commitments.
A service organization may maintain a detailed disaster recovery plan and still struggle to support its SOC 2 examination. The problem often starts when the CPA requests a system-generated population of recovery tests during the examination period. Management may have individual reports but lack a complete listing or evidence of backup integrity. This gap can lead to an exception and delay report issuance. Understanding how SOC 2 disaster recovery examinations work helps management understand what the CPA evaluates and why each recovery record matters.
Concern
Management documents a disaster recovery plan, but few teams understand how a CPA tests it or which records support it. An untested plan, a tabletop exercise that restores nothing, or a recovery target that contradicts actual results can produce an exception.
Overview
SOC 2 does not prescribe a specific recovery plan. The entity’s commitments set the bar. Recovery relates to A1.2 and A1.3 when management includes Availability in scope, CC7.5 for security incident recovery, and CC9.1 for business disruption. The CPA evaluates disaster recovery testing through inquiry, restoration sampling and inspection of supporting records.
Solution
The CPA compares each recovery commitment in management’s system description with supporting evidence. Auditors inquire about recovery owners and scenarios, sample restores against snapshot identifiers and integrity checks, and inspect test reports for dates, scope, results and deviations. They also compare achieved Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) with management’s targets.
Which SOC 2 Criteria Cover Disaster Recovery?
SOC 2 disaster recovery connects to specific Trust Services Criteria, depending on the examination scope and the entity’s control commitments.
What Do A1.2 and A1.3 Address?
A1.2 and A1.3 address recovery when management includes the Availability category in scope.
- A1.2: Addresses environmental protections, backup procedures and recovery infrastructure.
- A1.3: Addresses testing recovery plan procedures to support the entity’s ability to meet its availability commitments.
A1.3 provides a direct basis for evaluating disaster recovery testing. However, the CPA also examines the entity’s control wording to determine the expected evidence.
The AICPA Trust Services Criteria include points of focus that help explain relevant considerations. Points of focus provide guidance, rather than separate requirements. Availability also remains an optional Trust Services category.
How Do CC7.5 and CC9.1 Apply?
CC7.5 addresses the entity’s response to identified security incidents. Its points of focus include testing incident recovery plans.
CC9.1 addresses risk mitigation activities that help manage business disruption risks.
These criteria connect recovery activities to security incidents and broader business risks. However, the criteria do not prescribe a specific uptime figure or recovery duration. Management’s commitments in the system description establish the targets that the CPA evaluates.
How Does a CPA Perform Disaster Recovery Testing?
A CPA examines recovery activities through inquiry, inspection, observation and reperformance, depending on the control and available evidence.
What Are the Disaster Recovery Stages?
The below disaster recovery stages provide a practical basis for examining the recovery process.
- Scope: Identify the systems and services covered.
- Scenario: Identify the disruption or failure scenario.
- Recovery actions: Examine the actions that restore operations.
- Measured results: Compare actual recovery results with targets.
- Documented findings: Inspect deviations and management responses.
During inquiry, the auditor asks who declares an incident, who leads recovery and who communicates with customers.
Inspection covers the applicable plan version, assigned responsibilities and exercise records. The auditor also evaluates whether the documented procedures match the activities that management actually performs.
Why Does Restoration Test Sampling Matter?
A restoration test provides evidence that a backup can support recovery in a target environment.
The auditor first requests a system-generated listing of every recovery test during the examination period. This listing establishes the population from which the CPA selects samples.
An incomplete population limits the auditor’s ability to select representative samples. Individual test reports alone may not establish that management captured every exercise.
During a restoration test, the auditor examines snapshot identifiers, restore logs, target environments and integrity comparisons. These records help establish whether the entity restored the expected data and supported its RPO commitment.
For a Type 2 examination, the CPA selects samples across the examination period to evaluate operating effectiveness.
What Should a Disaster Recovery Test Report Contain?
A disaster recovery test report should contain enough dated evidence for the auditor to evaluate the specific control commitment. Auditors map each piece of evidence to the applicable criteria and assess whether the control operated effectively throughout the examination period.
Which Evidence Does the CPA Request?
The control wording determines the evidence request. A generic recovery checklist may overlook important records that support a particular commitment.
-
Recovery objectives per system
Criterion: A1.2, A1.3. Evidence requested: Start and end timestamps; achieved recovery point.
-
Backup scope and offsite copy
Criterion: A1.2. Evidence requested: Backup configuration, job logs and transfer confirmation.
-
Backup integrity
Criterion: A1.3. Evidence requested: Snapshot identifier, restore log and checksum comparison.
-
Recovery plan test
Criterion: A1.3, CC7.5. Evidence requested: Test plan, date, scope, participants, results and deviations.
-
Roles and communication
Criterion: CC7.5. Evidence requested: Role assignments, communication plan and action items.
-
Failover
Criterion: A1.3. Evidence requested: Change record, cutover evidence, replication lag and failback.
-
Business disruption risk
Criterion: CC9.1. Evidence requested: Risk assessment entry linked to the recovery plan.
How Does the Evidence Capture Sequence Support Testing?
The following records, among others, help the auditor trace a restoration exercise from authorization through its results:
- Record the applicable recovery plan version.
- Open a change ticket for the exercise.
- Capture the snapshot identifier before restoration.
- Export uncropped restoration console output.
- Compare row counts or cryptographic checksums.
- Log deviations on the exercise date.
Together, these artifacts establish the exercise context, technical execution and integrity results. The service auditor evaluates their consistency with the control description and other supporting records.
When Does Disaster Recovery Testing Produce Exceptions?
Disaster recovery testing can produce an exception when actual recovery performance fails to support management’s stated commitments.
What Happens When the Achieved RTO and RPO Miss Their Targets?
RTO measures the maximum recovery time management commits to achieving. RPO measures the maximum acceptable data loss, expressed as a period.
Consider two examples:
- RPO exception: Nightly full backups with log shipping disabled may support a 24-hour recovery point rather than a one-hour target.
- RTO exception: A cold standby environment that requires eight hours to restore operations contradicts a four-hour recovery target.
The auditor compares actual results with management’s documented targets. Realistic commitments can support the examination when evidence demonstrates consistent performance. A target that contradicts measured results may require an exception.
How Do Test Types and Subservice Organizations Affect the Opinion?
Each recovery exercise provides different evidence. The CPA evaluates whether the exercise matches the control commitment.
-
Tabletop
Evidence it supports: Decisions, roles and communication.
-
Restoration test
Evidence it supports: Backup readability and data integrity.
-
Full restore
Evidence it supports: Recovery of a complete system.
-
Planned failover
Evidence it supports: Controlled transition to a recovery environment.
-
Live failover
Evidence it supports: Recovery under an actual service transition.
-
Real incident
Evidence it supports: Actual recovery performance and response records.
A tabletop exercise supports a control that promises decision-making and coordination. It provides limited evidence for a control that promises technical restoration.
Other exception triggers include missing tests, backups within the same production failure domain and recovery procedures that rely on departed personnel.
Subservice organization treatment also affects the examination. Under the carve-out method, the CPA excludes the subservice organization's controls from the service auditor's examination opinion. Under the inclusive method, the examination includes relevant subservice organization controls and requires supporting evidence.
Conclusion
SOC 2 disaster recovery examinations focus on the relationship between management’s commitments and actual disaster recovery testing evidence. CertPro operates as an independent, licensed CPA firm conducting SOC 2 examinations under AICPA attestation standards. Auditors inspect recovery plans, examine test populations, sample restoration records and compare achieved RTO and RPO with stated targets. Dated, system-sourced evidence supports the CPA’s evaluation of control effectiveness and the resulting examination opinion.
