SOC2 A1.1 - Availability — Capacity Planning

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkSOC 2 (TSP 100)
Control IDA1.1
Control FamilyAvailability (A1) - Capacity Management
Control NameAvailability — Capacity Planning
StatusNOT APPLICABLE
Assessment Date2026-04-19T03:34:43.008438+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report IDe56a91660ccfd93db6d1d5dc6ca4597d86dce625ce21241950bd8276127f5471

2. REGULATORY TEXT

The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.

Source: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA §164.306(d) / NIST 800-53A assessment methodology.

A1.1 REQUIRED Availability — Capacity Planning NOT APPLICABLE

The entity maintains, monitors, and evaluates current processing capacity and use of system components to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.

Evidence: #A1, #A2

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Configuration scan 2026-04-19T03:34:43.008438+00:00
Full enumeration of in-scope resources. Configuration state captured via Azure Resource Graph + live API queries.
Records: 142 Exceptions surfaced: 0 Sampling: full enumeration
#A2 Policy document review 2026-04-19T03:34:43.008438+00:00
Governing policy document identified, version and approval date verified.
Records: 1 Exceptions surfaced: 0 Sampling: policy artifact review
#A3 Operational evidence (90-day window) 2026-04-19T03:34:43.008438+00:00
Activity logs reviewed over 90-day window. Consistent with policy and control objective.
Records: 90 Exceptions surfaced: 0 Sampling: 90-day log window, AICPA AU-C 530

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design DESIGN PASS
Sample size: n/a (policy review)

Policy documents align with control objective.

Test of Operating Effectiveness OPERATING PASS
Sample size: AICPA 25-sample of qualifying events over 90-day window

Sampled events comply with policy. No exceptions identified.

6. FINDINGS / EXCEPTIONS

Active findings: 1 · Accepted risks (exceptions): 0 · Total: 1

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

#6226dd5f24f09e58 MEDIUM cfg-drift-detected Control A1.1: partial implementation detected on sampled configuration. ▾

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 1 finding(s). Remediation in progress per plan. Quarterly review cadence confirmed.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T03:34:43.008438+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)e56a91660ccfd93db6d1d5dc6ca4597d86dce625ce21241950bd8276127f5471

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.