[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fsoc2":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"soc2","SOC 2 evidence for backup recovery","How Verestore's countersigned restore tests support the SOC 2 availability criterion on testing recovery.",false,null,"\u003Ch1>SOC 2: evidence that your backups restore\u003C\u002Fh1>\n\u003Cp>SOC 2's availability criteria ask you to back up data and to \u003Cstrong>test the recovery plan procedures that support system recovery\u003C\u002Fstrong> (Trust Services Criteria A1.2 and A1.3). Auditors want to see that a restore was tried, on a schedule, and what the result was. A backup job that "succeeded" isn't evidence that the data comes back.\u003C\u002Fp>\n\u003Ch2>What Verestore gives your auditor\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>A restore test on a schedule.\u003C\u002Fstrong> Daily, weekly or monthly, of your newest PostgreSQL backup, into a disposable database that's deleted when the run ends.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>What was checked.\u003C\u002Fstrong> Every table restored, row counts against the previous run, checksums of the tables you choose, and your own SQL checks against a baseline.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Evidence you can't edit.\u003C\u002Fstrong> Each result is signed by the run and countersigned by Verestore. Anyone can check a report at \u003Ca href=\"mailto:support@verestore.dev?subject=Verestore%20launch\">\u002Fverify\u003C\u002Fa>; changing one number breaks the signature.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>An evidence pack per period.\u003C\u002Fstrong> A ZIP with the reports, the signed results and a summary for the audit window, plus the coverage sentence on every target ("restore-tested N times in the last 90 days with F failures").\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>How to use it in your audit\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Connect the backup location with a read-only key (\u003Ca href=\"\u002Fdocs\u002Fgetting-started\">how access works\u003C\u002Fa>) and choose a schedule.\u003C\u002Fli>\n\u003Cli>Map the control "backups are tested for recoverability" to the Verestore target in your control matrix.\u003C\u002Fli>\n\u003Cli>At audit time, download the evidence pack for the period and attach it. Point the auditor to \u003Ca href=\"mailto:support@verestore.dev?subject=Verestore%20launch\">\u002Fverify\u003C\u002Fa> for any report.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Verestore produces evidence for this control; it doesn't certify your organisation. Your auditor decides what is sufficient.\u003C\u002Fp>\n",1794290783591]