What it means
Availability means that authorized users can obtain the service or information they need within acceptable conditions. The requirement is about useful service, not simply whether a computer answers a network check. A website can respond while its booking database is unavailable, leaving the actual business task impossible.
Start by defining what must work, for whom, and when. Then examine dependencies, capacity, failure handling, recovery, and operational support. Redundant components can help, but shared dependencies can still fail together. Planned maintenance and safe fallback procedures are part of availability engineering as much as protection against deliberate disruption.
The idea at a glance / Foundations
The page responds. Can the user do the job?
A landing-page probe passes while an authorized reader cannot retrieve an assigned burn vector.
Controlled 06:00 test: Kael is authorized to retrieve Chronos Hub MV-17 but has no active session. The identity service is down during the test; there is no working fallback.
READ THE PICTURE
Check useful access
The public landing page returns 200 OK, but Kael's sign-in depends on the unavailable identity service. At 06:00 Kael cannot retrieve assigned burn vector MV-17. The page-level probe passes while the authorized-user task fails.
Keep in mindThis establishes a failed task under the stated conditions. It does not measure an entire service period, every user, data correctness, or the effectiveness of a recovery plan.
Read the complete example
- Check useful access. The public landing page returns 200 OK, but Kael's sign-in depends on the unavailable identity service. At 06:00 Kael cannot retrieve assigned burn vector MV-17. The page-level probe passes while the authorized-user task fails. Kael is an authorized flight-dynamics reader who needs assigned burn vector MV-17 at 06:00. In this controlled test Kael has no active session, so fresh sign-in is required. The web process serves its public landing page with HTTP status 200 OK, but the identity service is deliberately unavailable and no fallback works. The sign-in attempt cannot complete and Kael obtains no record at the required time. Permission to read MV-17 is unchanged; inability to complete authentication is the failed dependency. A landing-page probe exercises a different path from sign-in plus record retrieval, so its success is compatible with unavailable useful service. Existing sessions or other users could behave differently; the test does not measure uptime over a period or prove that every route is unavailable. Restored availability would need a successful representative task under the required conditions, not merely a running host or a backup that has not been restored.
This establishes a failed task under the stated conditions. It does not measure an entire service period, every user, data correctness, or the effectiveness of a recovery plan.
Diagram references: NIST SP 800-12 Rev. 1 - Confidentiality, Integrity, and Availability
AN ILLUSTRATIVE SCENARIO
A transport dispatch service
A transport operator depends on a dispatch service during its morning departures. A routine infrastructure dashboard shows the web server running, but drivers cannot retrieve assignments because the identity service is unavailable. The operations team uses a documented temporary dispatch process while administrators restore access. Afterwards, the team adds an end-to-end check for the driver workflow and exercises the fallback. The incident shows why service availability must include authentication and other dependencies, rather than only the main application host.
Put it to work
- Define the critical user task and acceptable disruption with its owner, including important times, dependencies, and any safety-related constraints.
- Choose measures such as capacity planning, redundancy, monitoring, tested recovery, and practical fallback procedures based on that requirement.
- Test realistic dependency failures in a controlled setting and measure whether the user task and recovery process meet the agreed expectations.
How to check your work
Run a representative end-to-end task and a controlled recovery exercise. Record the observed service interruption and restoration result, including any dependency or manual step that limits the claimed availability.
Connect the ideas
- CIA triad
A shorthand for naming whether a loss is disclosure, unauthorized change, or downtime.
- Backup
A copy of data kept so integrity and availability can be restored after loss, preferably beyond the production identity’s reach.
- Ransomware
Malware or an operator model that denies availability of data, often by encryption, sometimes with theft for extra pressure.
- Defense in depth
Layering independent controls so that one failure does not become a complete compromise.