Availability: three criteria about staying up.

The criteria define availability as information and systems being ready for operation and use to meet your objectives. The category does not set a minimum uptime of its own, and it does not judge whether features work well. It looks at whether controls support the system being reachable, monitored and maintainable.

If buyers ask for Availability but no contract mentions uptime, ask why. Often a buyer's own continuity duties depend on you, and the category is how they get comfort. That is a sound reason; adding it for appearance is not.

1. A1.1
   Capacity is managedYou track how much capacity is used, forecast demand and add capacity before you run short. Example: utilisation dashboards with thresholds that open a ticket.
2. A1.2
   Protections, backups and recovery infrastructureYou build, run and watch environmental protections, backup processes and the infrastructure you would recover onto. Example: daily automated backups to a separate region with failure alerts.
3. A1.3
   Recovery plans are testedYou test the procedures that restore the system. Example: a documented restore test and a continuity exercise, with fixes logged.

1. 1Environmental threatsPower, fire, water, cooling. In the cloud these sit mostly with the provider; you show you rely on and review its report.
2. 2Backup distanceCopies far enough from the primary that one event is unlikely to take out both.
3. 3Alternate infrastructureA way to move processing elsewhere if the main environment is lost.
4. 4Restore integrityTesting that backups are complete and readable, not just that the job ran.

• Capacity. Monitoring dashboards, alert thresholds, and tickets raised when a limit was approached.
• Backups. Backup configuration, the job history for the period, and how failures were followed up.
• Restore test. A dated record of a restore: what was restored, from when, whether it worked, who checked.
• Continuity exercise. The scenario, who took part, what broke, and the plan changes that followed.
• Provider reliance. Your cloud provider's SOC report and your review of it, including its user-entity controls.

• No recovery test in the period. A Type 2 needs the test to happen inside the window. Last year's test does not count.
• Testing the backup job, not the restore. A green job status proves a file was written, not that the service can come back.
• A promise the design can't meet. A recovery time in the contract that a single-region setup could never achieve.
• Capacity alerts nobody reads. Thresholds that fire into a channel no one watches show monitoring, not management.
• Forgetting the provider. Relying on the cloud for environmental protection without reviewing its report.

• OverviewTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
• SecurityThe Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
• ConfidentialityThe Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
• PrivacyThe Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
• Processing IntegrityThe Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.

Sources: AICPA, TSP section 100, 2017 Trust Services Criteria (revised points of focus), availability category definition and criteria A1.1 to A1.3; AICPA DC section 200 for commitments in the system description. Examples are illustrative.