The SOC 2 Availability category addresses whether information and systems are available for operation and use as committed or agreed. It applies when availability commitments are part of the service description and intended report scope.
Standards and scope
Availability criteria extend the Security Common Criteria. The library helps teams evaluate the controls and evidence supporting capacity, environmental protection, recovery, backups, monitoring, and response to events that threaten availability.
- Availability scope begins with the service commitments, system requirements, and recovery expectations stated by the organization.
- Capacity and performance monitoring should be supported by retained, reviewable evidence.
- Backup, restoration, continuity, and recovery procedures need tests that match the assessment period and system scope.
- Incidents and availability events should connect to detection, response, root-cause, and corrective-action evidence.
- The Availability category is assessed alongside the Common Criteria selected for the same project.
Who this is for
- Students and continuity professionals learning how availability objectives become testable controls.
- Site reliability, infrastructure, operations, security, and compliance teams.
- SaaS and service organizations with uptime, recovery, or resilience commitments.
- Advisors and internal reviewers preparing Availability evidence for an examination.
What voiqq provides
- Availability-specific canonical mappings within the shared SOC 2 project.
- Fields for the population, sample period, test procedure, evidence, exception, and management response.
- Ownership and due dates for capacity, backup, disaster recovery, monitoring, and incident gaps.
- Evidence and validation history that remain connected to each finding.
- Combined reports when Security and Availability are included in one engagement.
A practical workflow
- Confirm that Availability belongs in the service commitments and report scope.
- Document uptime objectives, dependencies, capacity practices, recovery targets, and responsible owners.
- Collect evidence across the intended period and select representative samples.
- Record exceptions and remediation without overstating readiness.
- Retest changes and review the combined criteria before generating a snapshot.
Put the framework into practice
The Availability library gives operations and assurance teams a common record for resilience evidence and unresolved gaps instead of splitting the assessment across incident tools, backup logs, and spreadsheets.