SOC Business Continuity and Disaster Recovery 2

Question 1

Which availability monitoring control best satisfies AICPA Trust Services Criteria requirements?

Accepted Answer

Tracking system uptime against documented SLAs and investigating deviations

Answer

Monitoring actual uptime against committed SLAs and formally investigating deviations directly addresses the AICPA Availability criterion's requirement to meet performance commitments.

Question 2

What is the key distinction between a SOC 2 Type I and Type II report for business continuity controls?

Accepted Answer

Type I evaluates control design at a point in time; Type II tests operating effectiveness over a period

Answer

A SOC 2 Type I assesses whether controls are suitably designed at a specific date, while Type II assesses whether those controls operated effectively over a review period (typically 6–12 months).

Question 3

Which backup storage practice best supports SOC 2 availability and continuity requirements?

Accepted Answer

Encrypting backups and storing them at a geographically separated off-site location

Answer

Encrypting and storing backups at a geographically separate location protects against both unauthorized disclosure and site-wide disasters, supporting both the availability and confidentiality criteria.

Question 4

What does MTTR measure in the context of disaster recovery and system reliability?

Accepted Answer

The average time required to restore a failed system to normal operation

Answer

MTTR (Mean Time to Repair or Recover) is an operational metric reflecting the average time it takes to restore a failed system, indicating the efficiency of incident response and recovery processes.

Question 5

A SOC 2 auditor discovers the service organization's DR plan has not been tested in over 18 months. What is the most likely audit impact?

Accepted Answer

A noted control deficiency, as untested plans cannot demonstrate operating effectiveness

Answer

SOC 2 Type II requires evidence of operating effectiveness; a plan that has never been tested provides no such evidence, resulting in a documented control deficiency.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Business Continuity and Disaster Recovery 2