ASD ISM 1581 Monitor capacity and availability of online services
What it says
Continuous real-time monitoring of the capacity and availability of online services is performed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations monitor online services to ensure they can handle traffic and remain available at all times.
This control is about making sure that your online services, like your website or email, are always available and can handle all the traffic they get. If you don't keep an eye on these services, they might crash when too many people use them at once, causing you to lose customers or business opportunity.
Free. Save your status, tasks and notes.
Why it matters
Without real-time monitoring, capacity/availability issues may go undetected during spikes, causing outages, revenue loss and customer dissatisfaction.
How to implement
IT team should use online monitoring tools: Set up software tools that keep track of your website and online services to see how much they're being used and if they're slow or having issues.
These tools can alert you if something goes wrong, so you can fix it before it impacts your customers.
Service manager should review alert policies: Work with your IT team to decide what kinds of problems should trigger an alert.
Determine the threshold for acceptable performance and set alerts to notify you if performance drops below this level.
Operations team should regularly check reports: Have a dedicated staff member look at the reports generated by your monitoring tools to spot any patterns or issues that need attention.
This involves setting aside time each week to review the system's health and address any small problems before they become big ones.
Business owners should set up response plans: Get together with your team to come up with a plan for what to do if your service suddenly goes down or slows significantly.
Make sure everyone knows their role in getting things back up and running quickly.
IT team should test the handling of large traffic: Periodically run tests that simulate a large number of users to ensure your systems can cope.
This testing helps identify potential problems and gives you a chance to fine-tune your systems before real users are affected.
Keep it running
Set alert thresholds for traffic surges and key availability metrics; review dashboards and perform regular capacity checks to keep services online and respond quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The monitoring tool dashboard access: Request access to the live dashboard of the monitoring tools being used.
Look at
The types of metrics being monitored, such as uptime and response time.
Good evidence
Sign is if the dashboard shows active monitoring with historical data trends for at least the past three months.
- Check 2 of 5What an auditor asks for
Ask for
The alert configuration documentation: Request the document or setting logs that detail how alerts are configured. Look to ensure that there are alerts set for both capacity and performance issues.
Good evidence
Would be detailed configurations with clear thresholds and contact details for notifications.
- Check 3 of 5What an auditor asks for
Ask for
The report on system performance: Request regular summary reports that show how well the system has been performing.
Look at
Data on usage levels, response times, and outage records.
Good evidence
Would include consistent monthly reports showing positive performance or noted improvements.
- Check 4 of 5What an auditor asks for
Ask for
The incident response plan document: Request the documented plans that outline steps to be taken if systems fail. Look to see if roles and responsibilities are clearly defined and if there's a contact list readily available.
Good evidence
Includes a clearly written plan with realistic steps and roles assigned.
- Check 5 of 5What an auditor asks for
Ask for
Records of recent capacity tests: Request documentation or reports on recent tests conducted to check system capacity under high usage.
Look at
Details of the test results, including any issues found and steps taken to resolve them.
Good evidence
Shows tests conducted in the last six months with actionable follow-up on any issues encountered.
Mappings
Closest match in ISO/IEC 27001: A.8.6, Capacity management for resource use, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.6.
ISM-1581 requires continuous real-time monitoring of the capacity and availability of online services to ensure they can handle traffic and remain available. Annex A 8.6 requires organisations to monitor and adjust resource use to meet current and expected capacity requirements, which directly supports maintaining service availability. ISM-1581 is narrower and service-availability focused (online services, real-time), while Annex A 8.6 is broader capacity management across resources and includes adjustment actions beyond monitoring.
This control partially overlaps A.8.21.
Annex A 8.21 requires security mechanisms, service levels and service requirements for network services to be identified, implemented and monitored. ISM-1581 directly aligns with the monitoring aspect by requiring continuous real-time monitoring of capacity and availability of online services, which are common service-level attributes for network services. ISM-1581 is narrower (capacity/availability monitoring for online services), whereas Annex A 8.21 additionally addresses defining requirements and implementing security mechanisms beyond availability (e.g. protections, authentication, resilience).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.