# BSI C5 OPS-01 — Capacity Management - Planning

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_bsic5_ops01_dd027a1dfd-bsi-c5-ops-01-capacity-management-planning
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [BSI C5 (German Cloud)](https://support.icompaas.com/support/solutions/c_gen_bsi_c5) › [Operations Security](https://support.icompaas.com/support/solutions/folders/f_gen_cgenbsic5_operationssecurity)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

BSI C5 · Control OPS-01 · Priority: high · Component: Operations Security

### What this control covers

Plans personnel and IT resource capacities to avoid bottlenecks, forecasting future needs to meet service agreements. Implements measures to ensure service continuity during outages, protecting cloud customer data availability and performance requirements.

### Why it matters

A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.

### How to implement

#### AWS

Segment workloads into separate **VPCs/accounts per environment**. Use **security groups** as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and **VPC Flow Logs** to CloudWatch/S3. Front public services with **AWS WAF + Shield Advanced** and use **PrivateLink/VPC Endpoints** to keep service traffic off the internet.

#### Azure

Use **Network Security Groups** and **Application Security Groups** for east-west, and an **Azure Firewall** or NVA in a hub VNet for north-south. Enforce **Private Endpoints** for PaaS and turn on **Defender for Cloud — Network** for adaptive hardening recommendations.

#### GCP

Use **VPC Service Controls** to draw a perimeter around sensitive APIs and a hierarchical **Firewall policy** at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global **Cloud Load Balancer + Cloud Armor**.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Capacity Management - Planning.

### Quick checklist

-   Security — Measures / Agreements
-   Capacity — Measures / Agreements
-   Data — Measures / Agreements
-   Business — Measures / Agreements

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Ensure every Security Group is being used by at least one resource](https://support.icompaas.com/support/solutions/articles/62000129468-ensure-every-security-group-is-being-used-by-at-least-one-resource)
-   [2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected](https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected)
-   [Ensure that Activity Log Alert exists for Create or Update Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219859-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.