A1.1 Managing processing capacity

Current processing capacity and the use of infrastructure, data and software are maintained, monitored and evaluated so capacity demand can be managed and extra capacity added in time to meet objectives. Points of focus: usage is measured to set a capacity baseline and judge the risk of impaired availability; average and peak demand are forecast against capacity and tolerances, including capacity lost when components fail; and change management is triggered when forecasts exceed tolerances.

Source: SOC 2 (2017 Trust Services Criteria), A1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.