Capacity management

frameworkISO/IEC 27001:2022 sectionA.8 Technological controls csf 2.0DE.CM-09 PR.IR-04 topics— frameworks1 1 2

Official text · not licensableTitle: Capacity management. The control text is ISO's copyright; see ISO/IEC 27001:2022.

Wrong or missing mapping? Report it

Equivalents of A.8.6 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-09 PR.IR-04	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events; Adequate resource capacity to ensure availability is maintained	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.IR-04: related, not a mapping
CIS v8.1	CIS 10.1 CIS 2.6 CIS 2.7 CIS 9.1	Deploy and Maintain Anti-Malware Software; Allowlist Authorized Libraries…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +11 more loosely related (not mappings) CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 9.5 Implement DMARC Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 9.6 Block Unnecessary File Types Loosely related Only shares CSF DE.CM-09: related, not a mapping CIS 9.7 Deploy and Maintain Email Server Anti-Malware Protections Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 7 more in the downloads
SOC 2	A1.1	Capacity management to meet availability commitments	Editorial	ControlMapping editorial: Capacity: ISO's capacity management (A.8.6). 2 loosely related (not mappings) CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF DE.CM-09: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-09: related, not a mapping
PCI DSS	5.2.1 5.2.2 5.3.2 6.4.3	Anti-malware deployed on system components; Anti-malware detects, removes or contains known malware…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +5 more loosely related (not mappings) 10.3.4 File-integrity monitoring on logs Loosely related Only shares CSF DE.CM-09: related, not a mapping 11.3.1 Internal vulnerability scans every three months Loosely related Only shares CSF DE.CM-09: related, not a mapping 11.3.2 External ASV scans every three months Loosely related Only shares CSF DE.CM-09: related, not a mapping 5.4.1 Mechanisms to detect and protect against phishing Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 1 more in the downloads
CMMC	AC.L2-3.1.3 AU.L2-3.3.3 CA.L2-3.12.3 CM.L2-3.4.2	Control CUI Flow; Event Review…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +8 more loosely related (not mappings) CM.L2-3.4.3 System Change Management Loosely related Only shares CSF DE.CM-09: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-09: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-09: related, not a mapping SC.L2-3.13.7 Split Tunneling Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 4 more in the downloads
800-53	AU-4 CP-2 SC-5	Audit Log Storage Capacity; Contingency Plan…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping 19 loosely related (not mappings) AC-4 Information Flow Enforcement Loosely related Only shares CSF DE.CM-09: related, not a mapping AC-9 Previous Logon Notification Loosely related Only shares CSF DE.CM-09: related, not a mapping AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-09: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-09: related, not a mapping CM-3 Configuration Change Control Loosely related Only shares CSF DE.CM-09: related, not a mapping CM-6 Configuration Settings Loosely related Only shares CSF DE.CM-09: related, not a mapping CM-10 Software Usage Restrictions Loosely related Only shares CSF DE.CM-09: related, not a mapping CM-11 User-installed Software Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 11 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.308(a)(7)(ii)(A)	Information System Activity Review; Authorization and/or Supervision…	Loosely related	No mapping. Only shares CSF DE.CM-09, PR.IR-04: related, not a mapping +8 more loosely related (not mappings) §164.308(a)(7)(ii)(B) Disaster Recovery Plan Loosely related Only shares CSF PR.IR-04: related, not a mapping §164.308(a)(8) Evaluation Loosely related Only shares CSF DE.CM-09: related, not a mapping §164.310(a)(2)(i) Contingency Operations Loosely related Only shares CSF PR.IR-04: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 4 more in the downloads
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	6.6 6.9	Security patch management; Protection against malicious and unauthorised software	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping
Essential Eight	ISM-0109 ISM-0843 ISM-1228 ISM-1488	Event logs from workstations are analysed in a timely manner to detect cyber security…; Application control is implemented on workstations…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping +6 more loosely related (not mappings) ISM-1490 Application control is implemented on internet-facing servers Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1544 Microsoft’s recommended application blocklist is implemented Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1657 Application control restricts the execution of executables, libraries, scripts… Loosely related Only shares CSF DE.CM-09: related, not a mapping ISM-1870 Application control is applied to user profiles and temporary folders used by operating… Loosely related Only shares CSF DE.CM-09: related, not a mapping …and 2 more in the downloads
DORA	Art.9(1)Art.10(1)Art.10(3)	Protection and prevention; Detection…	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 5	Malware protection	Loosely related	No mapping. Only shares CSF DE.CM-09: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.