ASD ISM 1579 Dynamic resource scaling for demand spikes
What it says
Cloud service providers' ability to scale resources dynamically in response to genuine spikes in demand is discussed and verified as part of capacity and availability planning for online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCloud services must be able to scale resources quickly to handle sudden increases in demand.
Imagine running a popular online sale. If your cloud service can't handle the extra traffic, your website might crash, leading to lost sales and unhappy customers. This control ensures your cloud services can quickly ramp up resources to meet sudden demand, keeping your business running smoothly.
Free. Save your status, tasks and notes.
Why it matters
Without dynamic scaling, your service could crash under pressure, leading to lost sales or reputational damage.
How to implement
IT team should evaluate peak times: Identify common periods when demand spikes, such as during sales or marketing campaigns, to prepare resource allocation proactively.
Management should work with cloud service providers: Establish clear agreements on resource scaling capabilities and costs.
Make sure they can support your business needs without delay.
Procurement should review contracts: Ensure cloud service contracts include clauses for scalable resources without excessive costs or delays to prevent website downtime during peak periods.
Operations team should monitor performance: Use simple dashboards to keep an eye on server loads during peak times.
Adjust resources quickly based on real-time data to avoid slowdowns.
Staff should be trained: Provide training for key personnel on how to manually adjust or request additional cloud resources if automated scaling isn't sufficient.
Keep it running
Regularly review demand patterns and adjust automation rules to ensure resource scaling is in line with current business needs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the cloud service agreement: Request documentation detailing scaling capabilities and response times.
Look at
specifics on how quickly resources can be scaled.
Good evidence
includes a clear and reasonable timeframe for scaling.
- Check 2 of 5What an auditor asks for
Ask for
peak traffic analysis reports.
Look at
historical data showing traffic patterns and how resources were adjusted.
Good evidence
shows a clear pattern of timely scaling actions taken.
- Check 3 of 5What an auditor asks for
Ask for
monitoring tool outputs: Request logs or dashboards showing resource usage during demand spikes.
Look at
consistency in monitoring.
Good evidence
shows real-time data being effectively used.
- Check 4 of 5What an auditor asks for
Ask for
scaling policy documents: Request documents outlining the procedures for scaling.
Look at
clarity and practicality in steps.
Good evidence
includes step-by-step instructions used by the team.
- Check 5 of 5What an auditor asks for
Ask for
staff training records: Request records of training sessions focused on manual scaling procedures.
Look at
evidence of staff attendance and comprehension.
Good evidence
includes recent training dates and attendee lists.
Mappings
Closest match in ISO/IEC 27001: A.8.6, Capacity management for resource use, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.6.
Annex A 8.6 requires monitoring of resource use and adjustment in line with current and expected capacity requirements. ISM-1579 relates by requiring verification that cloud providers can dynamically scale resources in response to genuine demand spikes as part of capacity and availability planning. Both address ensuring sufficient capacity (including forward-looking planning), but ISM-1579 is scoped to cloud provider capability verification for online services rather than continuous internal monitoring and adjustment across all organisational resources.
This control partially overlaps A.8.21.
Annex A 8.21 focuses on defining and meeting security mechanisms and service levels for network services, including reliability and performance expectations. ISM-1579 relates by requiring verification of a cloud service provider's ability to dynamically scale during demand spikes as part of capacity and availability planning, which is an input to meeting agreed service levels. ISM-1579 is specific to cloud scalability and availability planning, while Annex A 8.21 is broader and includes security controls and ongoing monitoring across all network services, not just cloud capacity planning.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.