The Availability category is elected, not automatic. If your customer contracts carry uptime commitments you will usually scope it in, and then capacity planning, backup, and recovery testing become testable criteria rather than good practice. Restoration evidence from an actual test is what satisfies A1.3 — a backup job reporting success is not.
A1 Availability contains 3 criteria. The Trust Services Criteria define 61 in total: 33 Common Criteria across CC1–CC9 plus the criteria for the Availability, Confidentiality, Processing Integrity and Privacy categories.
No. A1 is only tested when you elect to include the Availability category in the engagement. The Common Criteria (CC1–CC9) are mandatory; the rest are scoped based on what you commit to customers.
A Type 1 assesses whether the controls are suitably designed at a point in time. A Type 2 also tests whether they operated effectively across a review period, typically 3 to 12 months, by sampling evidence from throughout that window. Most customers asking for a SOC 2 mean Type 2.