SOC2-A1.3 A1.3 Testing recovery plan procedures
SOC2-A1.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
A1.3 Testing recovery plan procedures. Procedures in the recovery plan that support system recovery are tested to confirm objectives can be met. Points of focus: business continuity plan testing is performed periodically, with scenarios weighted by how likely and how severe threats are, components across the organisation and its vendors that can impair availability, and unavailability of key people or vendors (vendors added in 2022), and plans are revised from the results; and backup data is tested periodically for integrity and completeness.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(7)(i) Contingency Plan (Standard) (closest match)
- 164.308(a)(7)(ii)(A) Data Backup Plan (Required) (closest match)
- 164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required) (closest match)
- 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan (Required) (closest match)
- 164.308(a)(7)(ii)(D) Testing and Revision Procedures (Addressable) (closest match)
- 164.310(a)(2)(i) Contingency Operations (Addressable) (closest match)
- 164.310(d)(2)(iv) Data Backup and Storage (Addressable) (closest match)
- 164.312(a)(2)(ii) Emergency Access Procedure (Required) (closest match)
NIST SP 800-53 Rev 5
- NIST800-CP-1 CP-1 Policy and Procedures (closest match)
- NIST800-CP-2 CP-2 Contingency Plan (closest match)
- NIST800-CP-3 CP-3 Contingency Training (closest match)
- NIST800-CP-4 CP-4 Contingency Plan Testing (closest match)
- NIST800-CP-7 CP-7 Alternate Processing Site (closest match)
- NIST800-CP-8 CP-8 Telecommunications Services (closest match)
- NIST800-CP-9 CP-9 System Backup (closest match)
- NIST800-CP-10 CP-10 System Recovery and Reconstitution (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: A - Availability), in our words, not a statement of the standard and not binding on an assessor.
- the capacity-monitoring record
- the backup and restore test record
- the recovery-plan test record
- the environmental-protection records