Capacity is managed to ensure system availability
Systems that run out of capacity fail. For availability commitments to be meaningful, organizations must anticipate growth, monitor utilization, and scale infrastructure before resource constraints affect users. This criterion requires active capacity planning and monitoring to prevent resource exhaustion from causing availability failures.
Implementation steps
- 1
Monitor resource utilization across all in-scope systems
Instrument your systems to track CPU, memory, disk, and network utilization continuously. For databases, track connection pool usage, storage growth, and query latency. For application services, track request rates, error rates, and response times. Set alert thresholds before capacity is exhausted, not after.
datadog aws-cloudwatch grafana new-relic - 2
Perform capacity planning aligned to growth projections
At least semi-annually, review current utilization trends and project forward based on expected growth. Identify any resources where current growth trajectories will cause capacity issues within the planning horizon. Create a capacity plan that documents current state, projected needs, and planned actions.
datadog aws-cloudwatch google-sheets notion - 3
Configure auto-scaling for variable load components
For components that experience variable load, configure auto-scaling to handle demand spikes without manual intervention. Define minimum and maximum capacity bounds. Test auto-scaling behavior under load. For databases and stateful components, plan capacity manually with headroom for peak loads.
aws-auto-scaling kubernetes gcp-autoscaler azure-vmss
Evidence required
Capacity monitoring dashboards or reports
Evidence that resource utilization is actively monitored.
- - Datadog or CloudWatch dashboard showing resource utilization
- - Capacity planning document or spreadsheet
- - Auto-scaling configuration with defined bounds
Capacity planning records
Evidence of proactive capacity planning.
- - Capacity review meeting notes or report
- - Infrastructure scaling plan based on growth projections
- - Alert configuration showing thresholds before capacity limits
Related controls
Environmental and infrastructure protections support system availability
Availability
Recovery procedures restore system availability after disruptions
Availability
Relevant security information is obtained and used
Communication and Information
Security controls are evaluated on an ongoing basis
Monitoring Activities