ISO 27001 Annex A 8.6 Capacity management for resource use
What it says
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure resources are monitored and adjusted to meet current and future needs to prevent system slowdowns or failures.
Capacity management is about keeping an eye on all the resources you use, like your computers and internet, to make sure they can handle how busy your business might get. If this isn't done, your systems could slow down or even crash, leading to loss of productivity and frustrated customers.
Free. Save your status, tasks and notes.
Why it matters
Poor capacity management can lead to critical system slowdowns or failures during peak times, disrupting operations and damaging customer trust.
How to implement
IT Manager should regularly review the current capacity of IT resources, such as servers and bandwidth, to ensure they can meet business demands.
They can do this by tracking system usage and performance trends using simple tools or dashboards, making adjustments before there are problems, such as obtaining additional infrastructure if needed, as suggested by ISO 27002:2022.
Operations Manager should identify future capacity needs based on planned business changes or expected growth.
This means talking to stakeholders about future projects or marketing initiatives and creating a forecast of resource needs. Consider what needs might arise from these changes, focusing especially on resources that take time to set up, like hiring new staff or expanding facility space.
Procurement team should be ready to acquire additional resources quickly.
They should establish relationships with suppliers who can deliver equipment or services at short notice, and maintain a list of preferred vendors for cloud services to leverage scalability features as highlighted in ISO 27002:2022.
HR should plan for human resource capacity changes, such as upcoming retirements or skill requirements.
They should keep a skills inventory and succession plans, so when capacity becomes tight, necessary personnel are already lined up or trained.
Resource Managers should create and maintain a documented capacity management plan for critical systems.
This should outline strategies for both scalability and reducing resource demand, such as cloud resource scaling or data archiving, to ensure essential systems continue to operate effectively under varying loads.
Keep it running
Implement capacity monitoring and trend reporting to forecast demand spikes and scale compute, storage and network resources before bottlenecks occur.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Capacity management plans and resource usage reports.
Look at
Review the plans for completeness, checking if they include predictions for future resource needs and historical usage data.
Good evidence
Plans include clear strategies for monitoring and adjusting capacity to meet both current and anticipated demands.
- Check 2 of 5What an auditor asks for
Ask for
Records of system stress testing results and follow-up actions.
Look at
Examine if tests were comprehensive and any issues found were addressed.
Good evidence
Test results identify any shortcomings and show concrete steps taken to address them to ensure system reliability during peak times.
- Check 3 of 5What an auditor asks for
Ask for
Procurement records for recent acquisitions of IT infrastructure.
Look at
Confirm that acquisitions align with predicted capacity needs and timelines.
Good evidence
Records show proactive acquisitions matching the capacity plan timelines, preventing last-minute scrambles.
- Check 4 of 5What an auditor asks for
Ask for
Personnel records and training logs.
Look at
Check if there is active management of staff capacity and skills development.
Good evidence
Records indicate staff levels and skills are managed in line with capacity needs, with regular updates and training plans.
- Check 5 of 5What an auditor asks for
Ask for
Employee surveys or feedback regarding system performance.
Look at
Look for comments about system delays or performance issues.
Good evidence
Feedback shows either no issues or identified issues are addressed promptly with documented action plans.
Mappings
Closest match in ASD Information Security Manual: ISM-2091, Enforce resource limits for AI models, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.6.
Annex A 6.2.6 requires the organisation to define and document the necessary elements for ongoing AI system operation, including system/performance monitoring, repairs, updates and support. ISO/IEC 27001 Annex A 8.6 focuses on monitoring and adjusting resource use, which is a subset of operational performance monitoring for AI systems. Annex A 6.2.6 also covers repairs, updates and support.
ASD Information Security Manual: 6 mappings
This control is broader than ISM-2091.
ISM-2091 requires organisations to enforce resource limits specifically for artificial intelligence models to prevent excessive consumption. ISO/IEC 27001:2022 Annex A 8.6 requires monitoring and adjusting resource use to meet current and expected capacity requirements, which can include setting quotas/limits for high-consumption workloads such as AI. Annex A 8.6 is broader (all ICT resource capacity), while ISM-2091 is a specific application focused on AI model resource limiting.
This control partially overlaps ISM-1431.
Annex A 8.6 requires resource use to be monitored and adjusted to meet current and forecast capacity requirements to avoid degradation or outages. ISM-1431 relates by requiring discussion of denial-of-service resilience, including availability monitoring, notification thresholds, and actions/thresholds to disable services, which are specific mechanisms for managing capacity under attack conditions. The overlap is mainly around monitoring thresholds and capacity planning, while ISM-1431 is limited to DoS scenarios and provider arrangements rather than general ongoing resource capacity management.
This control partially overlaps ISM-1579.
Annex A 8.6 requires monitoring of resource use and adjustment in line with current and expected capacity requirements. ISM-1579 relates by requiring verification that cloud providers can dynamically scale resources in response to genuine demand spikes as part of capacity and availability planning. Both address ensuring sufficient capacity (including forward-looking planning), but ISM-1579 is scoped to cloud provider capability verification for online services rather than continuous internal monitoring and adjustment across all organisational resources.
This control partially overlaps ISM-1581.
ISM-1581 requires continuous real-time monitoring of the capacity and availability of online services to ensure they can handle traffic and remain available. Annex A 8.6 requires organisations to monitor and adjust resource use to meet current and expected capacity requirements, which directly supports maintaining service availability. ISM-1581 is narrower and service-availability focused (online services, real-time), while Annex A 8.6 is broader capacity management across resources and includes adjustment actions beyond monitoring.
This control partially overlaps ISM-2114.
ISM-2114 involves establishing baselines for AI performance and behaviour to monitor deviations. Annex A 8.6 requires monitoring and adjusting resource use, linked with aspects of AI performance baselining, like resource utilisation. Annex A 8.6 focuses on capacity management, while ISM-2114 covers broader AI performance aspects.
This control supports ISM-2090.
Annex A 8.6 requires monitoring and adjustment of resource use to prevent performance degradation or failures due to capacity shortfalls. ISM-2090 supports this by applying rate limiting to AI model inference queries, which directly reduces the risk of resource exhaustion and helps keep service demand within manageable capacity. ISM-2090 is a targeted protective control for a specific workload, whereas Annex A 8.6 is broader and includes monitoring and planning for overall resource capacity.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.