SOC2 A1.3 - Availability — Recovery Procedures

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkSOC 2 (TSP 100)
Control IDA1.3
Control FamilyA1 - Recovery
Control NameAvailability — Recovery Procedures
StatusPARTIALLY IMPLEMENTED
Assessment Date2026-04-19T03:34:43.008438+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report ID56911c34ff5de37db6f1b9375cd08cf7904f435a1c039eb4035aeb037447520c

2. REGULATORY TEXT

The entity tests recovery plan procedures supporting system recovery to meet its objectives.

Source: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA §164.306(d) / NIST 800-53A assessment methodology.

A1.3 REQUIRED Availability — Recovery Procedures PARTIALLY IMPLEMENTED

The entity tests recovery plan procedures supporting system recovery to meet its objectives.

Evidence: #A1, #A2

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Configuration scan 2026-04-19T03:34:43.008438+00:00
Full enumeration of in-scope resources. Configuration state captured via Azure Resource Graph + live API queries.
Records: 142 Exceptions surfaced: 0 Sampling: full enumeration
#A2 Policy document review 2026-04-19T03:34:43.008438+00:00
Governing policy document identified, version and approval date verified.
Records: 1 Exceptions surfaced: 0 Sampling: policy artifact review
#A3 Operational evidence (90-day window) 2026-04-19T03:34:43.008438+00:00
Activity logs reviewed over 90-day window. Consistent with policy and control objective.
Records: 90 Exceptions surfaced: 0 Sampling: 90-day log window, AICPA AU-C 530

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design DESIGN PASS
Sample size: n/a (policy review)

Policy documents align with control objective.

Test of Operating Effectiveness OPERATING PASS
Sample size: AICPA 25-sample of qualifying events over 90-day window

Sampled events comply with policy. No exceptions identified.

6. FINDINGS / EXCEPTIONS

Active findings: 1 · Accepted risks (exceptions): 0 · Total: 1

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

#503681324195efd1 MEDIUM cfg-drift-detected Control A1.3: partial implementation detected on sampled configuration. ▾

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 1 finding(s). Remediation in progress per plan. Quarterly review cadence confirmed.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T03:34:43.008438+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)56911c34ff5de37db6f1b9375cd08cf7904f435a1c039eb4035aeb037447520c

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.