This requirement exists to improve resource utilization by identifying inefficiencies and implementing optimization measures and to ensure operational services are managed consistently, reliably, and with appropriate control.
Define and document the process for improve resource utilization by identifying inefficiencies and implementing optimization measures. Establish accountable owners, inputs and outputs, approval or validation points, operating criteria, schedules or thresholds where applicable, exception handling, monitoring, reporting, review, and evidence requirements. Integrate the process with change, incident, risk, asset, security, and service-management processes where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.1 – Resources |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.6-3.4 – Capacity and Performance Management; §2.13-3.1.1 – Capacity monitoring |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 19) Incident Response & Management – 19.6 Crisis communications, reputation management and capacity planning in resilience testing |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures; 6.1 RC.RP: Incident Recovery Plan Execution |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 11(2)(a) – Continuity of critical or important functions Article 11(5) – Business impact analysis and critical functions/dependencies/interdependencies |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.6 – Capacity management |
ISO
Standard
|
v2022 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI04 – Managed Availability and Capacity > BAI04.01 – Assess current availability, performance and capacity and |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.18 – SYSTEM AND COMMUNICATIONS PROTECTION; SC-6 – RESOURCE AVAILABILITY |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Infrastructure Resiliency – Capacity |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: A1.1 – Availability – The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives. |
AICPA
Audit Framework
|
vLatest | View → |