ISO 27001 Capacity Management: Ensuring Resource Availability
ISO 27001 capacity management ensures that information processing resources are available when needed and that capacity is aligned with business requirements. Under Annex A.12.1.3 of ISO 27001:2022, organisations must monitor, plan and adjust their capacity to prevent system degradation and service interruptions. This guide covers what capacity management means in an ISMS context, the specific requirements of Annex A.12.1.3, and how to build a capacity management process that satisfies auditors and keeps your operations running.
Published: July 2026 | Last updated: July 2026 | Author: Bitrixme Compliance Team
What Is Capacity Management in ISO 27001?
Capacity management is the process of ensuring that an organisation’s IT infrastructure and information processing resources have sufficient capacity to meet current and future business demands. Within an ISO 27001 ISMS, capacity management is treated as a security control because inadequate capacity can lead to system failures, data loss, degraded security controls and availability breaches.
The discipline covers all resources that support information processing: servers, storage, network bandwidth, database throughput, power and cooling, cloud service quotas, and human resources. Effective capacity management prevents the security failures that result from resource exhaustion – for example, failed backups due to insufficient storage, dropped monitoring data because of full log partitions, or application timeouts caused by undersized compute resources.
| Resource Type | Capacity Risk | Security Impact |
|---|---|---|
| Storage | Disk space exhaustion | Failed backups, audit log loss, system crashes |
| Compute (CPU/RAM) | Resource saturation | Application timeouts, security tool degradation, authentication delays |
| Network bandwidth | Congestion and latency | Log transmission delays, replication failures, DDoS susceptibility |
| Database throughput | Connection pool exhaustion | Transaction failure, SIEM query timeouts, access control delays |
| Cloud service quotas | API rate limiting | Monitoring gaps, automated response failures, reporting delays |
Annex A.12.1.3 Requirements
Annex A.12.1.3 states: “The use of resources shall be monitored, tuned and projections made of future capacity requirements to ensure the required system performance.” This control sits within the Operations Security domain (Clause 12) of Annex A and is closely linked to A.12.3 (backup), A.12.4 (logging and monitoring), A.12.6 (technical vulnerability management), and A.17 (business continuity).
What the auditor will look for:
- A documented capacity management policy or procedure
- Evidence that resource usage is monitored on an ongoing basis
- Capacity planning documentation that includes future projections
- Aligned capacity thresholds for critical resources
- Evidence that capacity issues are identified and resolved before they cause service degradation
- Capacity review reports presented to management
| Audit Requirement | Evidence the Auditor Expects | Common Finding |
|---|---|---|
| Monitoring of resource usage | Dashboards, monitoring tool configuration, alert history | No monitoring of key resources (storage, memory, bandwidth) |
| Capacity tuning | Change records for capacity adjustments, auto-scaling policies | Reactive tuning only – no proactive adjustment |
| Future capacity projections | Annual or quarterly capacity plan, growth modelling documents | No forward-looking capacity planning |
| Performance requirements | SLAs, performance baselines, service level targets | Undefined or outdated performance targets |
Capacity Planning Process
A structured capacity planning process is the backbone of ISO 27001 capacity management. The process should be documented within your ISMS and reviewed at least annually. The following steps form a complete capacity planning cycle:
- Establish baselines – Measure current resource utilisation across all critical systems. Capture peak, average and trend data for CPU, memory, storage, I/O and network utilisation.
- Define thresholds – Set warning and critical thresholds for each resource type. For example, storage at 75 per cent utilisation triggers a warning; 90 per cent triggers an escalation.
- Model growth – Project future resource requirements based on business growth plans, new system deployments, user growth rates and data accumulation trends.
- Identify gaps – Compare projected requirements against current capacity. Identify where and when capacity shortfalls will occur.
- Plan remediation – Document the actions needed to address each gap. Include upgrade timelines, budget estimates and responsible parties.
- Implement and monitor – Execute the remediation plan and continue monitoring to confirm that adjustments achieve the desired effect.
- Review and report – Present capacity status and plan to management as part of the ISMS management review process.
Monitoring and Thresholds
Continuous monitoring is essential for effective ISO 27001 capacity management. Your monitoring infrastructure should track key resource metrics in real time and alert the appropriate teams when thresholds are breached.
| Resource | Metric | Warning Threshold | Critical Threshold | Monitoring Tool Examples |
|---|---|---|---|---|
| Disk storage | Utilisation percentage | 75% | 90% | Prometheus, Zabbix, CloudWatch, Azure Monitor |
| Memory (RAM) | Utilisation percentage | 80% | 95% | Grafana, Nagios, Datadog, SolarWinds |
| CPU | Utilisation percentage | 80% sustained | 95% sustained | PRTG, New Relic, Dynatrace |
| Network bandwidth | Utilisation percentage | 70% | 90% | SolarWinds, PRTG, Zabbix |
| Database connections | Active connections vs pool size | 70% pool used | 90% pool used | PgBouncer, SQL Server DMV, RDS monitoring |
| Backup storage | Remaining days of capacity | 14 days remaining | 7 days remaining | Veeam, Backup exec, cloud backup consoles |
Capacity Management in Cloud Environments
Cloud infrastructure introduces specific capacity management considerations that your ISO 27001 ISMS must address. Unlike on-premises environments, cloud capacity is elastic but subject to service quotas, API rate limits and cost constraints.
- Auto-scaling policies – Define minimum, maximum and desired capacity for auto-scaling groups. Ensure scaling policies align with security requirements (for example, instances should boot with the latest patched AMIs).
- Service quotas – Monitor cloud service quotas (vCPU limits, API request rates, storage account limits). Request increases before hitting limits, especially for production workloads.
- Cost-aware capacity planning – Cloud capacity management must balance performance with cost. Implement budget alerts and cost anomaly detection to prevent runaway spending during scaling events.
- Multi-region capacity – For disaster recovery requirements, plan capacity across multiple cloud regions. Test that sufficient capacity exists in the DR region to handle a full failover.
- Reserved vs on-demand – Use reserved instances or savings plans for baseline capacity and on-demand for burst capacity. Document the cost-performance rationale in your capacity plan.
| Cloud Provider | Capacity Management Service | Key Quotas to Monitor |
|---|---|---|
| AWS | AWS Compute Optimizer, Trusted Advisor, CloudWatch | EC2 vCPU limit, RDS storage limit, S3 request rate, Lambda concurrency |
| Azure | Azure Advisor, Monitor, Cost Management | VM vCPU quota, Storage account capacity, Cosmos DB RU/s |
| GCP | Google Cloud Quotas, Recommender, Monitoring | Compute Engine CPU quota, Cloud Storage bucket limit, BigQuery slot reservation |
Reporting and Management Review
ISO 27001 requires that capacity management findings are reported to management as part of the ISMS management review process (Clause 9.3). A capacity management report should include:
- Current utilisation summary – Dashboard-style overview of all monitored resources, showing utilisation percentages against thresholds.
- Incident history – Record of any capacity-related incidents or near-misses during the reporting period, including root cause and resolution.
- Trend analysis – Month-on-month or quarter-on-quarter utilisation trends. Identify resources approaching warning thresholds.
- Projection update – Updated capacity projections based on new business information. Compare against previous projections to assess accuracy.
- Remediation status – Status of capacity remediation actions from the previous reporting period. New actions required for the next period.
- Budget impact – Actual and projected spending on capacity increases, compared against budget.
The report should be reviewed at least quarterly for critical systems and annually for the full ISMS. Management must approve capacity investments and take ownership of capacity risks exceeding accepted thresholds.
Capacity Management and Business Continuity
Capacity management is directly linked to ISO 27001 Annex A.17 (business continuity). Your business continuity plan must account for the capacity needed to maintain or restore operations during a disruption. This includes:
- Minimum capacity requirements – Define the minimum IT capacity needed to maintain essential operations during a disruption.
- DR site capacity – Ensure the disaster recovery site has sufficient capacity to handle production workloads. Test this during DR exercises.
- Scalability during incidents – Some security incidents (such as DDoS attacks) require rapid capacity scaling. Document how to scale under attack conditions.
- Communication infrastructure – Ensure capacity for alternative communication channels (phone systems, VPN concentrators, remote access) during an incident.
Frequently Asked Questions
Is capacity management mandatory for ISO 27001 certification?
Yes. Annex A.12.1.3 is a mandatory control in ISO 27001:2022. You must demonstrate that you monitor resource usage, tune capacity and project future requirements. However, the scope and depth of your capacity management should be proportionate to the size and complexity of your organisation.
What resources should be included in capacity management?
All resources that support information processing, including servers, storage, network bandwidth, database capacity, cloud service quotas, backup storage, power and cooling, and critical human resources. The specific resources depend on your ISMS scope and the criticality of each system.
How often should capacity be reviewed?
Automated monitoring should be continuous. Formal capacity reviews should occur at least quarterly for critical systems and annually for the full ISMS. Capacity projections should be updated whenever there is a significant change in business plans, system architecture or growth rates.
What is the difference between capacity management and performance management?
Capacity management focuses on ensuring sufficient resources exist to meet demand. Performance management focuses on the speed and efficiency of those resources. They are closely related but distinct. A system can have adequate capacity but poor performance due to misconfiguration, or good performance but insufficient capacity to handle growth.
Can cloud auto-scaling replace capacity planning?
No. Auto-scaling handles short-term demand fluctuations but does not replace strategic capacity planning. You still need to project long-term growth, manage service quotas, plan for reserved capacity, and ensure cost sustainability. Cloud environments can still run out of capacity – service quotas, region-specific availability and budget limits all require proactive planning.
How does capacity management relate to backup and availability?
Capacity management directly supports backup (Annex A.12.3) and availability (Annex A.17). Insufficient storage capacity is one of the most common causes of backup failure. Insufficient compute or network capacity during disaster recovery can delay restoration times and breach RTOs. Effective capacity management is a prerequisite for meeting your availability targets.
Strengthen Your Capacity Management with Bitrixme
Implementing effective ISO 27001 capacity management requires the right monitoring tools, documented processes and skilled oversight. Bitrixme helps GCC organisations design capacity management frameworks that meet Annex A.12.1.3 requirements, satisfy auditors and ensure resource availability. Our consultants can review your current capacity management practices, identify gaps and build a robust capability plan aligned with your ISMS.
Get in touch on WhatsApp for a quick consultation.
Tags: ISO 27001, capacity management, Annex A, resource planning, ISMS, availability
