# OPS-01 Capacity Management - Planning

- Domain: OPS – Operations
- Since C5:2020: unchanged
- Web page: https://c5.patrickscheid.de/en/ops-01/

**Supplementary information:**

For economic reasons, cloud service providers typically strive for a high utilisation of system components (CPU, RAM, storage space, network). In multi-tenant environments, existing resources should still be shared between cloud service customers (clients) in such a way that service level agreements are adhered to. In this respect, proper planning and monitoring of system components is critical to the availability and competitiveness of the cloud service. If the procedures are not documented or are subject to a higher degree of confidentiality as a trade secret of the cloud service provider, the cloud service provider should be able to explain the procedures at least orally within the scope of this audit.

## Basic criterion

### OPS-01.01B

The planning of capacities and resources (personnel and system components) follows an established procedure in order to avoid possible capacity restrictions.

**Supplementary information:**

Capacity restrictions are limitations in the cloud service provider's resources, resulting in disruptions of the cloud service or impacting compliance with contractual agreements and service levels.

### OPS-01.02B

The procedures include forecasting future capacity requirements in order to identify usage trends and manage system overload.

### OPS-01.03B

The cloud service provider takes appropriate measures to ensure that they continue to meet the requirements agreed with cloud service customers for the provision of the cloud service in the event of capacity restrictions or outages regarding personnel and system components. This applies in particular to those relating to the dedicated use of system components, in accordance with the respective agreements.

## Additional criterion

### OPS-01.01AC (additional, complementing)

The forecasts are considered in accordance with the service level agreement for planning and preparing the provisioning.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the capacity and resource requirements to be covered by the cloud service provider are planned and reflected in the SLA with the cloud service provider. The requirements are reviewed regularly and the adjustment of SLA demanded accordingly.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.