CC9 covers business disruption and vendor risk. Evidence spans BCDR test results and the third-party review files showing you assess the vendors that handle your data — including the sub-processors your customers will ask about.
CC9 Risk Mitigation contains 2 criteria. The Trust Services Criteria define 61 in total: 33 Common Criteria across CC1–CC9 plus the criteria for the Availability, Confidentiality, Processing Integrity and Privacy categories.
Yes. CC9 is part of the Common Criteria, which apply to every SOC 2 engagement regardless of which additional categories you scope in.
A Type 1 assesses whether the controls are suitably designed at a point in time. A Type 2 also tests whether they operated effectively across a review period, typically 3 to 12 months, by sampling evidence from throughout that window. Most customers asking for a SOC 2 mean Type 2.