Capacity management

Plain-language summary

Monitoring how much processing, storage, network, licence and cloud capacity you use and planning ahead, so that systems do not slow down, fill up or fall over — and so that security functions such as logging and backup do not quietly stop.

What the clause is really asking

Capacity sounds like an operations topic, and it is, but running out is an availability incident and often a security one: a full disk stops backups, a full log store stops logging, an overloaded firewall starts dropping traffic. The control asks you to identify the capacity requirements of your systems according to how critical they are, monitor actual use, tune systems where needed, and project future demand from business plans and trends so that you add capacity, or reduce demand, before it becomes a problem. Reducing demand counts: archiving old data, retiring unused systems, clearing obsolete mailboxes. The guidance reaches beyond IT kit to people and facilities, though audits usually focus on technology. The common misunderstanding is that cloud removes the problem. Cloud capacity is elastic but not unlimited: mailbox and storage quotas, API limits, licence counts and budget caps are capacity constraints too, and runaway auto-scaling is a cost risk. An ISO 9001 practitioner will recognise the infrastructure planning in clause 7.1.3.

What auditors look for

Auditors ask what you monitor and which thresholds trigger action, then look at the monitoring dashboard or the MSP's monthly report for disk, memory, processor, bandwidth and storage on critical systems. They look for an alert that fired and trace what was done about it. They ask how next year's capacity needs were estimated — new sites, more staff, a new ERP module — and who signed off the plan. They check backup and log storage specifically, because these fill silently. The hard question: which of your systems is closest to its limit right now, and when will it reach it?

Typical evidence

Capacity requirements for critical systems; monitoring tool configuration with thresholds and alert recipients; capacity reports from IT or the MSP; alert records and actions taken; capacity forecast or plan linked to business plans and budget; cloud quota, licence and storage utilisation reports; records of demand-reduction actions such as archiving and decommissioning.

How to comply — recommendations

List your critical systems and, for each, the resources that could run out: storage, memory, processing, bandwidth, licences, cloud quotas, and backup and log retention space. Set warning and critical thresholds in your monitoring tool — 80% and 90% are common starting points — and make sure alerts reach a named person. Ask your MSP for a monthly capacity report and read it. Once a year, before budgeting, write a one-page capacity forecast tied to the business plan: headcount growth, new sites, new systems, data growth. Set budget alerts on cloud subscriptions. Archive or delete data you no longer need, which also serves POPIA retention. Feed capacity-related incidents into the next forecast.

Common nonconformities

No defined capacity requirements for critical systems; monitoring in place but alerts unread or sent to an unmonitored mailbox; backup or log storage full, causing silent failures; no forecast of future capacity needs; capacity planning not linked to business plans; cloud quotas and licence limits unmanaged; repeat capacity incidents with no corrective action.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.