Skip to content

Capacity Management

What is Capacity Management?

The process of ensuring that IT resources and infrastructure are sufficient to meet current and future business requirements.

Governance

Each of these is named in at least one of the same controls as capacity management. The number is how many controls name both.

What the standards actually require on capacity management

Requirements naming capacity management across 6 standards, quoted from the control text.

C5 (Germany)3 controls

Give the cloud customer, so far as the service model permits, the means to monitor and steer the system resources allocated to it, so the customer can prevent resource contention and sustain adequate performance.

C5-OPS-03 · Capacity Management - Controlling of Resources →

Management implements capacity management integrated with budgeting and strategic planning that addresses internal factors such as growth, mergers, new products and technologies and external factors such as customer preferences, competitors and market requirem...

ffiec-it-examination-handbook::AIO-VI.B.6 · VI.B.6 Capacity Management (Architecture, Infrastructure, and Operations) →

Capacity requirements for human, technical, information and financial resources are determined, documented and maintained, taking account of service and performance requirements. Capacity planning covers current and forecast capacity based on demand;

iso-iec-20000-1-2018::8.4.3 · 8.4.3 Capacity management →

Maintenance and capacity management activities are performed for all assets within the function, planned to minimise operational impact and support availability.

australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3i · ARCHITECTURE-3i: Maintenance and capacity management for all assets →

Resource use is monitored and tuned, and future capacity needs are projected, so that systems perform as required. As an Annex A reference control it is compared with the controls chosen in risk treatment (6.1.3 c) and recorded in the Statement of Applicabilit...

iso-27001-2013::A.12.1.3 · Capacity management →

Resource use is to be monitored and adjusted to fit present and expected capacity needs. Purpose (stated in ISO/IEC 27002:2022): keeps enough capacity available in systems, staff, offices and other facilities.

iso-27001-2022::8.6 · Capacity management →

Questions people ask about capacity management

What is Capacity Management?
The process of ensuring that IT resources and infrastructure are sufficient to meet current and future business requirements.
Why is Capacity Management important for compliance?
Capacity Management is a key concept in Governance. Understanding capacity management helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Capacity Management?
Capacity Management appears in the requirement text of C5 (Germany), FFIEC IT Examination Handbook, ISO/IEC 20000-1:2018, Australian Energy Sector Cyber Security Framework (AESCSF), ISO 27001:2013. Across these standards we have identified 10 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Capacity Management?
Explore our compliance framework pages to see how capacity management applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Capacity Management applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Written and maintained by Gerard Blokdyk, The Art of Service.