ISO/IEC 27001 · Annex A 8.6

Capacity management

International Organization for Standardization (ISO) and IEC

Explanation

What it asks for. Monitor and adjust the use of resources in line with current and expected capacity requirements.

In practice. Capacity needs for compute, storage, network bandwidth, licences and people are identified for important systems. Usage is monitored with thresholds and alerts, and forecasts take account of business plans, seasonal peaks and new services. Where demand approaches limits, actions are planned in advance, such as scaling, archiving old data or optimising workloads, and cloud auto-scaling is configured within agreed cost limits. Evidence includes monitoring dashboards, capacity plans or forecasts and records of actions taken on alerts.

Common gaps. Monitoring exists but thresholds are not tied to planned growth, so capacity issues are found during outages. Capacity for security tooling, such as log storage and licences, is often overlooked and silently drops data when limits are hit.