Key takeaways
- Monitor and plan capacity so systems don't run out of resources.
- Running out of capacity causes outages and can weaken security controls.
- Start here: identify critical resources: compute, storage, bandwidth, people.
Purpose
Monitor and plan capacity so systems don't run out of resources.
Requirement
Requirement summaryThe use of resources shall be monitored and adjusted in line with current and expected capacity requirements.
Why it matters
Running out of capacity causes outages and can weaken security controls.
How to implement
- Identify critical resources: compute, storage, bandwidth, people.
- Monitor usage and set thresholds.
- Plan for growth and seasonal peaks.
- Review capacity in change and planning meetings.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.6. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for monitoring system capacity (storage, processing power, bandwidth).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.6 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Capacity monitoring reports or alerts.
- Capacity plans for key systems.
- Records of capacity issues and how they were fixed.
Things you should be able to show or explain
- IT should be able to explain how they spot capacity problems early.
How much to show: Two or three key systems.
Common mistakes
- No capacity monitoring.
- Repeated outages from running out of space.
- Disk space alerts ignored until systems stop.
- No forecast for growth.
- Tip: Set alerts at 80% utilisation.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.6 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.6?
Be ready to explain how the control works in your organisation and to provide things like: Your process for monitoring system capacity (storage, processing power, bandwidth)…