OPS-02 Capacity Management - Monitoring
Operate defined technical and organisational safeguards that monitor resource consumption and the provisioning and de-provisioning of cloud services, demonstrating that what is delivered stays within contractual agreemen
4
artefacts
1
held by a system
3
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Utilisation dashboard showing configured thresholds and current headroom per cluster · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Service level attainment report covering the assessment period · Cloud console / configuration management
- De-provisioning workflow record showing resources reclaimed after an account closed · Identity provider / directory
- Escalation record raised when a utilisation threshold was crossed · Cloud console / configuration management
governing documentDocuments that govern the control
none for this control
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Thresholds observed with no defined action once they are breached
- Capacity released by departing tenants never returned to the shared pool
- Service level attainment calculated by hand from figures that cannot be reproduced
- Alert points set above the level at which performance already degrades
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetOPS-01 Capacity Management - Planning · OPS-03 Capacity Management - Controlling of Resources