8.6 Capacity management
Resource use is to be monitored and adjusted to fit present and expected capacity needs. Purpose: have enough capacity in processing facilities, staff, offices and other facilities. Guidance: identify capacity requirements for processing facilities, staff, offices and other facilities in light of how critical the related systems and processes are; tune and monitor systems to secure and, where needed, improve availability and efficiency; stress-test systems and services to confirm there is enough capacity for peak demand; and put detective controls in place that flag problems early. Projections of future needs should take in upcoming business and system needs along with present and forecast trends in processing capability, with particular attention to resources that are costly or slow to procure, so managers and service or product owners monitor use of key resources. Managers use capacity information to spot and avoid resource limits and reliance on key individuals that could threaten security or services, and plan accordingly. Capacity can be met by adding supply (hiring staff, getting more space or facilities, buying more powerful processing, memory and storage, or using cloud computing whose elasticity allows fast scaling up and down) or by cutting demand (deleting obsolete data, disposing of paper records past retention, retiring applications, systems, databases or environments, optimizing batch jobs and schedules, tuning code or database queries, and restricting bandwidth for non-critical heavy services such as video streaming). For systems that are mission-critical, a written capacity plan is worth having. ISO/IEC TS 23167 explains cloud elasticity and scalability.
Source: ISO/IEC 27002:2022, 8.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Stress or load test results confirming capacity for peak demand · Source control / CI pipeline
- Records of actions taken to add capacity or reduce demand, and of key-person dependencies identified · Cloud console / configuration management
governing documentDocuments that govern the control
- Capacity requirements for critical systems, facilities and teams reflecting business criticality · Policy repository / GRC workspace
- Monitoring dashboards and alert thresholds for key resources such as CPU, memory, storage, bandwidth and licences · Policy repository / GRC workspace
- Capacity forecasts considering new business requirements, trends and long lead-time or high-cost resources · Policy repository / GRC workspace
- A written capacity plan for each mission-critical system · Policy repository / GRC workspace
First move
Common gaps auditors find
- Capacity is managed reactively after outages
- Load testing is never done before peak business periods
- Dependence on single key individuals is not treated as a capacity risk
- Cloud autoscaling limits are set without considering cost or quota ceilings
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet