Capacity management
Purpose
Monitor and tune resource use to keep enough capacity in processing facilities, people and facilities.
How to meet this control
In short: Monitor and tune resource use to meet capacity needs.
- Step 01Instrument infrastructure with monitoring such as CloudWatch, Azure Monitor, Datadog or Prometheus to track CPU, memory, storage and queue depth
- Step 02Set threshold alerts that warn before saturation, for example at 70 and 85 percent of a resource, routed to the on-call channel
- Step 03Use auto-scaling groups or elastic cloud services so capacity flexes with demand rather than relying on fixed provisioning
- Step 04Run periodic load and stress tests against critical services to confirm headroom for peak events such as campaigns
- Step 05Hold a regular capacity review that projects growth from business pipeline and decommissions unused resources
- Step 06Maintain a documented capacity plan covering forecasted demand and remediation options
Tip: Alerting on resource thresholds plus periodic capacity review.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Identify capacity needs based on the business criticality of the systems and processes
- ›Tune and monitor systems to maintain or improve availability and efficiency
- ›Run stress tests to confirm capacity can handle peak demand
- ›Put detective controls in place to flag emerging capacity problems early
- ›Project future needs from new business demands and current usage trends
- ›Increase capacity by adding staff, space, hardware or elastic cloud computing
- ›Reduce demand by deleting obsolete data, decommissioning systems and optimising code
- ›Throttle non-critical bandwidth-heavy services and keep a documented capacity plan
Audit evidence to keep
- - Monitoring dashboard showing resource utilisation trends over time
- - Capacity threshold alert configuration and a sample triggered alert
- - Auto-scaling policy or configuration for a critical service
- - Load or stress test report against a critical system
- - Capacity plan document with growth forecast and review minutes
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.8.6. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.