SOC 2 · A - Availability
SOC 2 A1.1: A1.1 Managing processing capacity
SOC 2 A1.1 covers A1.1 Managing processing capacity. The held text names 3 evidence records for it, the first being Capacity monitoring dashboards and thresholds for key components. The common gap an assessor flags is No capacity thresholds or alerts.
Current processing capacity and the use of infrastructure, data and software are maintained, monitored and evaluated so capacity demand can be managed and extra capacity added in time to meet objectives. Points of focus: usage is measured to set a capacity baseline and judge the risk of impaired availability; average and peak demand are forecast against capacity and tolerances, including capacity lost when components fail; and change management is triggered when forecasts exceed tolerances.
What evidence supports A1.1?
- Capacity managementCapacity monitoring dashboards and thresholds for key components
- Capacity managementCapacity forecasts or reviews with resulting actions
- Capacity managementAuto-scaling configuration or capacity change tickets
Where this requirement comes from
This is our own statement of SOC 2 A1.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- No capacity thresholds or alerts
- Forecasts ignore failure of a component or region
- Capacity breaches with no follow-up change
How it maps to ISO 27001:2022
- 8.6 high Maintaining, monitoring and evaluating processing capacity against demand is capacity management.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.