Why it matters
Running out of capacity (storage, compute, bandwidth) can itself become an availability incident.
How a self-led small team implements it
Basic cloud provider usage alerts/dashboards are legitimate evidence at small scale — no need for dedicated capacity planning software.
What auditors expect to see
Monitoring dashboards, usage alerts.
Track A.8.6 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS