PR.IR-04 says adequate resource capacity to ensure availability is maintained. Disks fill, quotas run out, and traffic spikes. This outcome asks you to watch resource use and add capacity before the shortage becomes an outage.
CSF is voluntary guidance with no certification attached.
What good looks like
You track storage, compute, memory, network bandwidth, and licensed or quota based limits for every important system. Alerts fire well before a limit. Someone reviews growth monthly and plans the next increase.
How to implement it
- List the limits that can stop you: disk, database connections, API rate limits, cloud service quotas, certificate and license counts.
- Graph current use against each limit.
- Alert at a threshold that leaves days, not minutes, to respond. Eighty percent is a common start.
- Review the trend monthly and estimate when each limit will be hit.
- Turn on autoscaling where it is safe, and request quota increases early where it is not.
Which limits actually stop you
Teams usually watch CPU and forget the rest. The limits that cause outages in practice are often quieter: a database running out of connections, a disk that reaches one hundred percent because logs were never rotated, a cloud service quota that blocks a deployment, an API rate limit at a payment or email provider, and an expired certificate or license. Write them all in a table with the current value, the limit, and the owner.
Forecasting without a data science team
Plot the last six months of each metric and draw a straight line. If the line crosses the limit within a quarter, schedule the work. Adjust for known events: a launch, a big customer onboarding, a seasonal peak. Review the table at a regular monthly meeting that takes fifteen minutes. The point is the habit, because capacity problems almost always announce themselves weeks in advance.
Spending wisely
More capacity costs money, so tie it back to the availability targets you set under PR.IR-03. A system with a loose target can run closer to its limit than one that carries revenue. Note the decision either way, so an auditor or customer can see that the margin was chosen on purpose.
Evidence to collect
- Dashboards showing utilization against limits.
- Alert rules with thresholds.
- A monthly capacity review note.
- Tickets showing capacity added ahead of need.
Common gaps
Monitoring CPU only while disks quietly fill. No awareness of cloud quotas until a deploy fails. Alerts that go to a channel nobody reads. Forecasts that ignore a planned launch.
Quick check
Does autoscaling satisfy this outcome?
It helps, but quotas, databases, storage, and licenses often do not scale automatically. You still need to monitor and forecast those.
Sources
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), PR.IR-04 and its implementation examples.
