# SOC 2 A1.2 — Management of Backup, Recovery, and Environmental Controls

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_soc2_a12_48a71ddc49-soc-2-a12-management-of-backup-recovery-and-environmental-controls
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [SOC2 Readiness](https://support.icompaas.com/support/solutions/62000111733) › [Availability](https://support.icompaas.com/support/solutions/folders/f_gen_62000111733_availability)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

SOC 2 · Control A1.2 · Priority: high · Component: Availability

### What this control covers

The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

Use **Backup and DR Service** for VM/DB and managed snapshot policies for disks; replicate critical GCS to a different region + project under separate IAM.

#### Google Workspace

**Google Vault** retention rules cover Gmail/Drive/Chat; combine with periodic third-party backups (e.g., Spanning, Backupify) for full restore-by-user.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.
-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Signed policy or standard documents the safeguard. Focus: Management of Backup, Recovery, and Environmental Controls (Original component: Availability).

### Quick checklist

-   Risk — Objectives / Controls
-   Business — Objectives / Controls
-   Management — Objectives / Controls
-   Data — Objectives / Controls

### Related articles on this site

-   [Ensure Backup Data in Recovery Services Vaults Is Encrypted Using Customer-Managed Keys (CMK)](https://support.icompaas.com/support/solutions/articles/62000234845-ensure-backup-data-in-recovery-services-vaults-is-encrypted-using-customer-managed-keys-cmk-)
-   [NIST 800-171 3.4.8 Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.](https://support.icompaas.com/support/solutions/articles/62000229287-nist-800-171-3-4-8-apply-deny-by-exception-blacklisting-policy-to-prevent-the-use-of-unauthorized-s)
-   [NIST 800-171 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.](https://support.icompaas.com/support/solutions/articles/62000229335-nist-800-171-3-13-2-employ-architectural-designs-software-development-techniques-and-systems-engine)
-   [CMMC 2.0 CM.3.069 Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.](https://support.icompaas.com/support/solutions/articles/62000229472-cmmc-2-0-cm-3-069-apply-deny-by-exception-blacklisting-policy-to-prevent-the-use-of-unauthorized-so)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): The full SOC 2 implementation guide: scoping the Trust Services Criteria, the roadmap to a Type 2 report, and what the auditor samples.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Teams that finish SOC 2 usually add ISO 27001 next; the control overlap is large and the guide explains what is genuinely extra.