Draft v0.1.04 of 6 frameworks
Capacity and availability management
System capacity and performance are monitored and managed to meet availability commitments.
Where it appears
- SOC 2
A1.1Maintains, monitors and evaluates current processing capacity- PCI DSS 4.0
- no direct requirement
- NIST CSF 2.0
PR.IR-04Adequate resource capacity to ensure availability is maintained- ISO 27001:2022
A.8.6Capacity management- HIPAA Security Rule
- no direct requirement
- NIST 800-53 r5
SC-5Denial-of-service protection
Availability-driven; no direct PCI DSS or HIPAA Security Rule citation.
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Capacity and performance monitoring dashboards or alerts
- Capacity planning reviews
- Uptime/availability reports against commitments
Crosswalks that include this
SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to ISO 27001:2022NIST CSF 2.0 to NIST 800-53 r5ISO 27001:2022 to SOC 2ISO 27001:2022 to NIST CSF 2.0ISO 27001:2022 to NIST 800-53 r5NIST 800-53 r5 to SOC 2NIST 800-53 r5 to NIST CSF 2.0NIST 800-53 r5 to ISO 27001:2022