Service Commitments
Availability, monitoring, backup, recovery, support, and escalation expectations are defined, measured where applicable, and reviewed.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Availability, support, monitoring, backup, and recovery expectations are specific enough to operate and measure, and the company can show whether it met them over the relevant period.
First SOC 2 program
Define one honest set of service hours, uptime calculations, support severity levels, response targets, backup expectations, and recovery goals. Use existing monitoring and support tools to produce dated monthly records rather than relying on recollection.
As the company scales
Manage service-level objectives by product or tier, automate measurement from authoritative monitoring and ticket data, review trends with service owners, and connect missed expectations to incident, problem, and customer-communication workflows.
Collect service hours, uptime, monitoring, support, escalation, backup, and recovery commitments and identify the products and customers to which each applies.
You should end up with: An expectation register with scope, owner, source, and measurement requirement.
Document the data source, calculation window, time zone, numerator, denominator, exclusions, maintenance treatment, and responsible reviewer for each measured expectation.
You should end up with: A reproducible measurement method for each service metric.
Define severity criteria, response ownership, response-time starting and stopping points, escalation thresholds, coverage hours, and customer communication routes.
You should end up with: An approved severity and escalation matrix reflected in the support system.
Set monitoring, ticketing, status, and backup systems to retain timestamps, state changes, acknowledgments, and outcome data needed to evaluate performance.
You should end up with: System configurations and periodic exports that preserve the relevant operating history.
Have service owners review calculated results, missed targets, backup or recovery exceptions, major support escalations, and data-quality concerns on a defined cadence.
You should end up with: A dated service review with results, decisions, and assigned corrective actions.
Investigate missed expectations, correct the underlying issue, evaluate customer impact, and complete required customer reporting or notification.
You should end up with: Linked incident or problem records, remediation evidence, and applicable customer communications.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Availability and support expectations are defined for the applicable service and customer population with measurable calculations, hours, severity, response, and escalation terms.
Include this context
service and customer scope
Include this context
availability or support target
Include this context
measurement window and exclusions
Include this context
support hours and severity rules
Include this context
response and escalation timing
Include this context
effective version
Weak evidence to avoid
A sales sheet promising 99.9 percent uptime and fast support without a calculation method, service scope, coverage hours, exclusions, severity definitions, or effective date.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Service owners reviewed availability, support, backup, recovery, missed targets, and data quality and assigned corrective or customer-facing action.
Include this context
review period and service
Include this context
attendees and owner
Include this context
metrics and exceptions reviewed
Include this context
missed target analysis
Include this context
decision and action owner
Include this context
due date and status
Weak evidence to avoid
Meeting notes stating service healthy without the measured results, support exceptions, backup outcomes, target misses, or follow-up decisions considered.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Service availability and operational health were measured from defined authoritative signals across the relevant period and scope.
Include this context
service and environment
Include this context
metric and data source
Include this context
observation period
Include this context
target and actual result
Include this context
exclusions or adjustments
Include this context
review timestamp
Weak evidence to avoid
A live status tile showing 100 percent now with no retained monthly history, source checks, applicable target, maintenance treatment, or service boundary.
Confirm what the record proves
Scheduled backups and recovery activities supporting service expectations completed, exceptions were handled, and recoverability was demonstrated where applicable.
Include this context
protected system or data set
Include this context
backup or recovery job identifier
Include this context
scheduled and completion time
Include this context
result and exception
Include this context
recovery test scope and outcome
Include this context
reviewer
Weak evidence to avoid
A screenshot showing backup enabled without job history, protected scope, failed-job follow-up, or any result demonstrating that data could be recovered.
Type 1
Current approved service-level and support definitions, monitoring and support configurations, backup and recovery settings, and the latest service review as of the examination date.
Type 2
Every scheduled service-reporting interval, support case subject to a response target, scheduled backup job, planned recovery exercise, and service review due during the review period for in-scope services.
Reconcile reporting periods to retained monitoring calculations, support cases to the target-eligible ticket population, backup schedules to job history, and the service-review calendar to completed review records, investigating all gaps and exclusions.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Availability, support, monitoring, backup, and recovery expectations are specific enough to operate and measure, and the company can show whether it met them over the relevant period.
Compare the documented owner with the intended role (Service Owner / Legal / CISO), then compare dated records with the stated cadence: Ongoing; review at least annually.
Reconcile reporting periods to retained monitoring calculations, support cases to the target-eligible ticket population, backup schedules to job history, and the service-review calendar to completed review records, investigating all gaps and exclusions.
Current approved service-level and support definitions, monitoring and support configurations, backup and recovery settings, and the latest service review as of the examination date.
Every scheduled service-reporting interval, support case subject to a response target, scheduled backup job, planned recovery exercise, and service review due during the review period for in-scope services.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Availability and support expectations are defined for the applicable service and customer population with measurable calculations, hours, severity, response, and escalation terms.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Service owners reviewed availability, support, backup, recovery, missed targets, and data quality and assigned corrective or customer-facing action.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Service availability and operational health were measured from defined authoritative signals across the relevant period and scope.
For each selected record, confirm it demonstrates Scheduled backups and recovery activities supporting service expectations completed, exceptions were handled, and recoverability was demonstrated where applicable.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.