Capacity management

What the control asks

Resource use is to be monitored and adjusted to fit present and expected capacity needs. Purpose: have enough capacity in processing, people, premises and other facilities. Guidance: identify what capacity the processing, people, premises and other facilities need in light of how critical the related systems and processes are; tune and monitor systems to secure and, where needed, improve availability and efficiency; stress-test systems and services to confirm there is enough capacity for peak demand; and put detective controls in place that flag problems early. Projections of future needs should take in upcoming business and system needs along with present and forecast trends in processing capability, with particular attention to resources that are costly or slow to procure, so managers and service or product owners monitor use of key resources. Managers use capacity information to spot and avoid resource limits and reliance on key individuals that could threaten security or services, and plan accordingly. Capacity can be met by adding supply (hiring staff, getting more space or facilities, buying more powerful processing, memory and storage, or using cloud computing whose elasticity allows fast scaling up and down) or by cutting demand (deleting obsolete data, disposing of paper records past retention, retiring applications, systems, databases or environments, optimizing batch jobs and schedules, tuning code or database queries, and restricting bandwidth for non-critical heavy services such as video streaming). For systems that are mission-critical, a written capacity plan is worth having. ISO/IEC TS 23167 explains cloud elasticity and scalability.

Purpose in the standard’s terms, in our words: Keeps enough capacity available in systems, staff, offices and other facilities.

Attribute values in one line: Preventive, Detective; Integrity, Availability; Identify, Protect, Detect; Continuity; Governance and ecosystem, Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Capacity requirements for critical systems, facilities and teams reflecting business criticality
• Monitoring dashboards and alert thresholds for key resources such as CPU, memory, storage, bandwidth and licences
• Stress or load test results confirming capacity for peak demand
• Capacity forecasts considering new business requirements, trends and long lead-time or high-cost resources
• A written capacity plan for each mission-critical system
• Records of actions taken to add capacity or reduce demand, and of key-person dependencies identified

Where audits commonly find gaps

• Capacity is managed reactively after outages
• Load testing is never done before peak business periods
• Dependence on single key individuals is not treated as a capacity risk
• Cloud autoscaling limits are set without considering cost or quota ceilings

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. Its earlier numbering (12.1.3) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 8.30 Outsourced development
• 8.20 Networks security
• 8.7 Protection against malware

Read the five attributes All 93 controls