A.8.6
Capacity management
Technological controlsCheckpoints 5Evidence 6Cases 5
Control objective
This control requires the organization to monitor and tune the use of information processing resources (compute, memory, storage, network bandwidth, human resources, and so on) and to forecast future demand so that needed capacity is secured in time. The objective is to prevent performance degradation and service outages caused by resource exhaustion while avoiding wasteful over-provisioning, thereby sustaining service availability and continuity.
Key checkpoints
- Are the resources subject to capacity management (CPU, memory, storage, network bandwidth, and so on) and their performance metrics identified per key system/service, with baselines defined?
- Is resource utilization monitored continuously, with warning/critical thresholds set so that alerts and responses occur when they are exceeded?
- Is demand forecasting performed based on historical trends and business plans (new services, user growth, and so on), and is it linked to budget/procurement planning?
- Are response options for capacity shortfalls (resource expansion, reclamation/optimization, load balancing, data cleanup, and so on) defined in advance?
- In cloud/outsourced environments, is the manual or automatic scaling approach defined and, where auto-scaling is used, are bounds/quotas and cost controls (such as budget alerts) configured and operated together?
Implementation guidance
- Define the resources and performance metrics (response time, throughput, utilization, and so on) to be managed per key service, and establish baselines for the normal state.
- Monitor resource utilization and service performance and set alerts that leave enough time to respond. Choose threshold values and levels, such as warning/critical, according to service behavior and operational capability, and review alert effectiveness.
- Perform demand forecasting based on historical usage trends and business plans, and compare/adjust forecast against actuals on a regular cycle (for example, quarterly).
- Prepare response options for shortfalls in advance, including resource expansion, reclamation/optimization of unused resources, load balancing, and archiving/data cleanup.
- Assess cloud scaling capabilities and service constraints to select manual or automatic expansion. Where autoscaling is used, set bounds and quotas, and manage availability and cost through purchasing choices and budget alerts.
- Link capacity planning with procurement lead times so that budget and orders are completed before the point at which expansion is needed.
Evidence
- Capacity management policy/procedure and the list of managed resources/performance metrics
- Resource utilization monitoring dashboards/reports and threshold configuration records
- Capacity/demand forecast reports and periodic capacity review meeting minutes
- Resource expansion/adjustment history (change management records, order/procurement documents)
- Cloud auto-scaling and budget alert configuration screens
- Threshold-exceeded alerts and response action records
Nonconformity examples
- Managed resources and thresholds are not defined, so utilization is not noticed until it reaches saturation.
- Log collection/backup halts due to insufficient storage, but with no early-warning scheme it is discovered only after the fact.
- No capacity sizing is performed when introducing a new service, causing performance degradation/outage right after launch.
- Cloud auto-scaling bounds are misconfigured: a too-low upper bound causes an outage during a traffic surge, or the absence of one lets costs climb until a budget cap or quota curtails the service.
- Demand forecasting is performed but procurement lead time is not considered, so the timing of expansion does not match actual demand.