A1.1 Maintains capacity to meet availability commitments
Maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help m.
5
artefacts
2
held by a system
3
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring evidence of current processing capacity and use across infrastructure, data and software components · SIEM / log platform
- Defined thresholds and alerting on approach to capacity limits, with evidence of the alerts raised in the period · SIEM / log platform
periodic reviewEvidence produced at each review
- Capacity forecasts reflecting expected demand, business change and growth, with the review cycle and who performs it · Cloud console / configuration management
- Records of capacity being added or adjusted as a result of the evaluation · Cloud console / configuration management
- Evidence capacity management covers cloud quotas and licence limits, which behave as hard capacity constraints · Cloud console / configuration management
governing documentDocuments that govern the control
none for this control
First move
Start with the 2 of 5 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Utilisation monitored with no defined threshold, so evaluation only happens after the availability commitment is missed
- Forecasting based on past trend with no input from planned business change
- Capacity considered for compute and storage while log storage, database connections and quota limits are unmanaged
- Evaluation performed with no record, so the criterion cannot be tested even though the activity occurs
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA1.2 Environmental protections, data backups, and recovery infrastructure support availability