← SOC 2 Trust Services Criteria in plain English

A1.3 A1

Availability / A1.3

Testing the recovery plan rather than trusting it

Think of it likeActually trying the spare key, to find out it was cut wrong.

In plain English

Recovery procedures are tested on a defined schedule, and what the test reveals is fed back into the plan. An untested backup is a hope rather than a control.

Related CSF, CIS and ISO controls (unofficial mapping)