Capacity management

What the requirement asks

Resource use is to be monitored and adjusted to fit present and expected capacity needs. Purpose: have enough capacity in processing facilities, staff, offices and other facilities. Guidance: identify capacity requirements for processing facilities, staff, offices and other facilities in light of how critical the related systems and processes are; tune and monitor systems to secure and, where needed, improve availability and efficiency; stress-test systems and services to confirm there is enough capacity for peak demand; and put detective controls in place that flag problems early. Projections of future needs should take in upcoming business and system needs along with present and forecast trends in processing capability, with particular attention to resources that are costly or slow to procure, so managers and service or product owners monitor use of key resources. Managers use capacity information to spot and avoid resource limits and reliance on key individuals that could threaten security or services, and plan accordingly. Capacity can be met by adding supply (hiring staff, getting more space or facilities, buying more powerful processing, memory and storage, or using cloud computing whose elasticity allows fast scaling up and down) or by cutting demand (deleting obsolete data, disposing of paper records past retention, retiring applications, systems, databases or environments, optimizing batch jobs and schedules, tuning code or database queries, and restricting bandwidth for non-critical heavy services such as video streaming). For systems that are mission-critical, a written capacity plan is worth having. ISO/IEC TS 23167 explains cloud elasticity and scalability. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Capacity management prevents a security failure caused by exhaustion. The guidance asks for the measure, the threshold, the forecast and the action.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep capacity requirements for critical systems, facilities and teams reflecting business criticality and one live sample together.

Evidence an assessor asks for

• Capacity planningCapacity requirements for critical systems, facilities and teams reflecting business criticality
• Capacity planningMonitoring dashboards and alert thresholds for key resources such as CPU, memory, storage, bandwidth and licences
• Capacity planningStress or load test results confirming capacity for peak demand
• Capacity planningCapacity forecasts considering new business requirements, trends and long lead-time or high-cost resources
• Capacity planningA written capacity plan for each mission-critical system
• Capacity planningRecords of actions taken to add capacity or reduce demand, and of key-person dependencies identified

The question an assessor will ask

An assessor will ask for capacity requirements for critical systems, facilities and teams reflecting business criticality, then trace it to the system it protects. For A.8.6 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Capacity is managed reactively after outages
• Load testing is never done before peak business periods
• Dependence on single key individuals is not treated as a capacity risk
• Cloud autoscaling limits are set without considering cost or quota ceilings

Before the next audit

Before the next audit, check one live sample for this gap: capacity is managed reactively after outages.