A1.2: Environmental protections, backups and recovery infrastructure

Systems are protected from environmental threats, data is backed up, and the infrastructure needed to recover exists and is designed to meet recovery objectives.

Category: Availability (optional category) · Series: A1 (Availability) · TSC 2017 (2022 points of focus)

That summary is Policyseed’s own paraphrase, written to be read next to the policy sections below. The authoritative wording is the AICPA’s Trust Services Criteria, which the CPA firm tests your controls against during the examination.

Policies that address A1.2

The Policyseed crosswalk points A1.2 at 3 policies. Each link opens the full sample text at the section an auditor would read. Section 4 holds the statements management commits to; section 5 holds the procedures that produce evidence.

• P14 Business Continuity and Disaster Recovery Policy, section 4 (Policy Statements). Owner: Engineering Lead.
• P15 Backup and Recovery Policy, section 4 (Policy Statements). Owner: Engineering Lead.
• P21 Physical and Remote Work Security Policy, section 4 (Policy Statements). Owner: IT/Operations Lead.

Evidence examples for A1.2

Artifacts a company of 5 to 200 people can realistically produce. The Audit Kit’s evidence checklist lists them per policy with an owner column so each one has a name against it before the examination.

• Backup configuration screenshot showing schedule, retention and encryption for production data
• Cloud provider SOC 2 report covering environmental controls for the regions in use
• Architecture diagram showing multi-availability-zone or multi-region deployment for critical services
• Backup job success report for the last 90 days

Related criteria in A1 (Availability)

• A1.1: Capacity management
• A1.3: Recovery testing

Previous: A1.1 Capacity management. Next: A1.3 Recovery testing. All 38 criteria are listed on the template index.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.