Requirement
The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.
Points of Focus
Measures Current Usage
Requirement: The use of the system components is measured to establish a baseline for capacity management and to use when monitoring and evaluating the risk of impaired availability due to capacity constraints.
Forecasts Capacity
Requirement: The expected average and peak use of system components is forecasted and compared to system capacity and associated tolerances. Forecasting considers system resilience and capacity in the event of the failure of system components that constrain capacity.
Makes Changes Based on Forecasts
Requirement: The system change management process is initiated when forecasted usage exceeds capacity tolerances.
Explanation
Availability starts with knowing how much load your systems can handle. This criterion requires measuring current usage, forecasting future demand, and adding capacity before shortages cause outages. Auditors look for monitoring baselines, capacity forecasts, and evidence that changes are triggered when projected use approaches system limits.
