Control A.8.6Capacity management
The use of resources must be monitored and adjusted in line with current and expected capacity requirements.
Capacity is an availability control, and it is in the technological section because exhaustion is a security event: a system that cannot process is unavailable whether the cause is an attack or a forecast that was wrong.
The control asks for monitoring of current use and projection of future need, with adjustment before the limit is reached — storage, compute, network, licences, and the human capacity to operate the systems.
Cloud elasticity changes the shape of this rather than removing it. Capacity becomes a cost and a quota question instead of a procurement one, and an automatic scaling response to a volumetric attack converts an availability problem into a financial one.
The capacity limits that cause the most surprise are the ones nobody monitors because they are not obviously capacity — certificate lifetimes, identifier ranges, log retention, and the quotas a provider applies per account.
How to put this in place
Systems that run out of disk, memory, bandwidth or budget fail at the worst moment, and an availability failure is a security failure too. Your ISMS needs early warning so growth is planned, not discovered during an outage.
- Decide which systems are critical enough to track.
- Choose the capacity measures that matter for each, such as storage, processing, connections and spend.
- Set alerts well before the limits and, in cloud estates, set quotas and budget alerts.
- Send alerts to a named person who acts on them.
- Review trends at least quarterly and record the decisions made.
Evidence an auditor usually looks for: monitoring dashboards with alert thresholds, and capacity review records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.