Request for Interim BCP/DRP Evidence While 2025 SOC 2 & SOC 3 Reports Are Pending

Question

Since the 2025 SOC 2 and SOC 3 reports are not yet finalized or published, could you also confirm whether Microsoft can provide any available evidence of Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) testing for the 2025 period?

Any interim artifacts—such as confirmation of test execution, high‑level results, or statements confirming the continuity of these controls—would be very helpful for our internal audit and compliance requirements until the updated SOC reports are released.

Thank you.

Answer 1

Microsoft provides various external audits and certifications related to Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP). While the 2025 SOC 2 and SOC 3 reports are not yet finalized or published, you can refer to the existing documentation that outlines related external regulations and certifications. For instance, the SOC 1 and SOC 2 reports include sections on business continuity and disaster recovery procedures, which may contain interim evidence of testing and execution of these plans.

For specific interim artifacts such as confirmation of test execution or high-level results, you may need to check the Service Trust Portal for the latest updates or reach out to Microsoft directly for any interim evidence they can provide during this period.

---

References:

• Resiliency and continuity overview
• System and Organization Controls (SOC) 2 Type 2
• System and Organization Controls (SOC) 1 Type 2
• Microsoft 365
• Related external regulations and certifications
• Office 365 and SOC 1 Type 2
• Office 365 and SOC 2
• SOC reports