A8.6 Capacity management

ISO 27001 A8.6 Capacity management emphasizes the proactive monitoring and management of system resources (e.g., servers, storage, networks, applications) to ensure optimal performance, cost-efficiency, and readiness for growth or unexpected spikes in demand.

Capacity management ensures that an organization’s information systems and services can handle current workloads and scale to meet future demands without performance degradation or security risks. Poor capacity planning can lead to system downtime, data loss, performance bottlenecks, and failure to meet service level agreements (SLAs).

Implementation Guide #

Step 1: Establish Capacity Baselines

• Identify critical systems and measure current performance and usage metrics (e.g., CPU, memory, disk I/O, bandwidth).
• Set performance thresholds and acceptable limits.
  → Tool Recommendation: Use monitoring tools like Nagios, Zabbix, Datadog, or SolarWinds to collect and visualize baseline data.

Step 2: Implement Real-Time Monitoring and Alerts

• Continuously monitor system resources and receive alerts for threshold breaches.
• Ensure high availability and quick response to resource saturation.
  → Tool Recommendation: Prometheus + Grafana, AWS CloudWatch, Azure Monitor, or New Relic for proactive alerts and dashboards.

Step 3: Perform Trend Analysis and Forecasting

• Use historical data to analyze usage patterns and predict future demand.
• Plan upgrades or resource scaling based on forecasted growth.
  → Tool Recommendation: Splunk ITSI, Elastic Stack, or Datadog Capacity Planning for forecasting and analytics.

Step 4: Align Capacity with Business and Security Requirements

• Ensure capacity planning supports security requirements such as redundancy, failover, and performance during security events (e.g., DDoS attacks).
• Maintain compliance with SLAs and regulatory uptime standards.

Step 5: Automate Resource Scaling (Cloud Environments)

• Enable auto-scaling for cloud infrastructure to dynamically adjust resources.
  → Tool Recommendation: AWS Auto Scaling, Azure Virtual Machine Scale Sets, Google Cloud Autoscaler.

Step 6: Document and Review Capacity Plans

• Create a capacity management plan and update it periodically.
• Include resource forecasts, performance reports, and upgrade schedules.
  → Tool Recommendation: Use Confluence, ServiceNow, or Jira Service Management to document and track plans.

Step 7: Integrate Capacity Management with Change and Incident Management

• Ensure capacity changes are logged, reviewed, and approved through formal change management.
• Use incident reports to identify capacity-related problems.
  → Tool Recommendation: ServiceNow, BMC Remedy, or Freshservice for integration with ITSM processes.

Templates #

• Capacity Management Plan Template
• System Resource Baseline Report
• Capacity Monitoring Dashboard
• Forecast and Trend Analysis Report
• Capacity-Related Change Request Form

Example #

A company’s web servers frequently crashed during product launches due to traffic spikes. After assessing system baselines, they implemented AWS Auto Scaling and monitoring via CloudWatch. They also set up forecasting using Datadog, which allowed them to proactively scale resources before peak demand. Now, the system remains stable even under high load, reducing downtime and improving customer experience.

Without capacity management, performance degradation would continue, impacting business operations and customer trust.

How to Comply #

To comply with ISO 27001 A.8.6, organizations should:

• Monitor and measure resource usage across key systems.
• Establish and maintain capacity thresholds and alerts.
• Forecast future requirements based on trends and business growth.
• Document capacity planning procedures and integrate them with IT operations.
• Regularly review and adjust resource allocations to meet performance and security goals.

How to Pass an Audit #

Key Documents to Prepare:

• Capacity Management Plan
• System Performance Reports
• Resource Monitoring and Alerting Configuration
• Forecasting and Upgrade Schedules
• Change Logs for Capacity-Related Events

What the Auditor Will Check:

• Are current system capacities measured and documented?
• Are there alerts and actions defined for resource threshold breaches?
• Is there evidence of forecasting and planning for future demand?
• Are capacity decisions reviewed and aligned with business needs?
• Are capacity-related issues integrated into change/incident management?

Top 3 Mistakes People Make #

• Ignoring performance metrics until systems fail.
• Failing to plan for future growth or seasonal demand spikes.
• Not integrating capacity planning with change or incident management.

ISO 27001 Capacity Management FAQ #

Q1: How often should capacity be reviewed?
At a minimum, capacity should be reviewed quarterly or after any significant change in usage patterns or infrastructure.

Q2: What’s the difference between capacity planning and performance tuning?
Capacity planning is proactive and long-term (ensuring enough resources in the future), while performance tuning is reactive and short-term (optimizing current configurations).

Q3: Is capacity management necessary in cloud environments with auto-scaling?
Yes. While auto-scaling helps, you must still plan, monitor costs, ensure availability, and avoid resource limits or billing surprises.

ISO 27001 Controls and Attribute Values #

Effective capacity management prevents system failures, supports security and availability goals, and aligns IT operations with strategic business objectives.