How the evidence maps to common frameworks
Clause references use the public control titles. Your plan decides which apply, and your auditor decides what satisfies them.
ISO/IEC 27001:2022
A.8.13 Information backup, A.5.29 Information security during disruption and A.5.30 ICT readiness for business continuity: verified backups, a readable copy during disruption and a rehearsed restore.
ISO/IEC 27017
Cloud-service guidance that shares backup responsibility between provider and customer: Atlassian keeps Confluence running; the customer keeps the copy.
SOC 2 (Availability)
Backup processes and recovery infrastructure, and criterion A1.3 on tested recovery plan procedures: the quarterly restore into a scratch space is the test, its JSON check the record.
NIS 2, Article 21(2)(c)
Business continuity, such as backup management and disaster recovery: scheduled backups, verification that fails loudly, and a documented, rehearsed restore.
ISO 9001:2015, clause 7.5.3
Control of documented information: availability, protection and retention of the procedures, policies and records a quality system keeps in Confluence.
Climakers itself is not certified under SOC 2, ISO 27001, ISO 27017 or other equivalent attestations. References to these frameworks describe the design intent of the tools and are not a representation of certification; customers remain responsible for their own assessments, evidence and controls.
The evidence, as commands
Four scheduled runs cover a space. Keep the directory on storage you control and retain the JSON records for your retention period.
Nightly: a restorable native backup
$ acs2md space get by-key DOCS --output-dir /backups
Nightly: verify it, keep the record
$ acs2md space check by-key DOCS --backup-dir /backups --fail-on-drift -f json > /backups/DOCS.check.json
Quarterly: rehearse recovery into a scratch space
$ acs2md space restore by-key DOCS-DR --backup-dir /backups/DOCS --create-space --mode all --yes
Weekly: a readable continuity copy
$ acs2md space convert by-key DOCS --output-dir /continuity --sync
Access review belongs in the same plan: acs2md space permissions and space properties export who can reach each space. The full recipe, with the two cautions a rehearsal needs, is in the documentation.