What this control covers
Plans personnel and IT resource capacities to avoid bottlenecks, forecasting future needs to meet service agreements. Implements measures to ensure service continuity during outages, protecting cloud customer data availability and performance requirements.
Why it matters
A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Capacity Management - Planning.
Quick checklist
- Security — Measures / Agreements
- Capacity — Measures / Agreements
- Data — Measures / Agreements
- Business — Measures / Agreements