Operations and Business Resilience · Topic 3 of 8
Availability, Capacity and Service Level Management
Managing availability and capacity, monitoring and trend analysis, service level and operational level agreements, and reporting against targets.
- 3 min
- Remove single points of failure to improve availability.
- MTBF high is good; MTTR low is good.
- Capacity management forecasts from trends and business plans.
What it is
Availability management makes sure systems are up when the business needs them. Capacity management makes sure there are enough processing, storage and network resources for current and future demand, at a sensible cost. Service level management agrees service targets with the business and reports how well IT meets them.
How it works
Availability
Availability is usually expressed as the percentage of agreed service time that a service is available. Factors that improve it include redundant components, removal of single points of failure, good change management, monitoring that detects problems early, and fast incident response.
| Term | Meaning |
|---|---|
| Single point of failure | A component whose failure stops the whole service |
| Mean time between failures (MTBF) | Average operating time between failures; higher is better |
| Mean time to repair (MTTR) | Average time to restore after a failure; lower is better |
Capacity management
- Understand business plans and expected demand (new products, growth, seasonal peaks).
- Monitor current utilization of CPU, memory, storage and bandwidth.
- Analyze trends and forecast when thresholds will be reached.
- Plan upgrades or scaling before performance suffers.
Cloud services allow scaling on demand, but capacity still needs planning for cost control and service limits. The auditor looks for monitoring with thresholds and alerts, documented forecasts linked to business plans, and evidence that warnings were acted on.
A system that slows down every month-end is a capacity management finding. The fix is forecasting from trends and business calendars, not adding hardware after each incident.
Service level management
| Agreement | Between | Content |
|---|---|---|
| Service level agreement (SLA) | IT or a provider and the business customer | Service description, availability, response and resolution times, responsibilities, reporting |
| Operational level agreement (OLA) | Internal IT teams | Support commitments that let IT meet the SLA |
| Underpinning contract | IT and an external supplier | Supplier commitments that support the SLA |
SLA targets must be measurable and agreed by the business. Reporting should come from reliable data, cover all agreed metrics and include trend analysis and action plans for breaches.
What the auditor checks
- SLAs exist for critical services and reflect business requirements.
- OLAs and supplier contracts support the SLA targets; a four-hour SLA backed by a next-business-day supplier contract cannot be met.
- Performance data is accurate and independently generated where possible.
- Repeated breaches lead to corrective action, not just reports.
How the exam asks about this
- "Which agreement supports an SLA between internal IT teams?" An operational level agreement.
- "Performance degrades every quarter-end." Capacity planning based on trend analysis and business cycles.
- "The provider reports 99.9 percent availability from its own tool." Verify the measurement method and data source.
What to remember for the exam
- Remove single points of failure to improve availability.
- MTBF high is good; MTTR low is good.
- Capacity management forecasts from trends and business plans.
- SLAs are with customers; OLAs are internal; underpinning contracts are with suppliers.
- Verify how service metrics are measured.
An SLA that excludes planned maintenance, measured only during office hours, can report excellent figures while users suffer outages at night.
Common mistakes
Confusing SLAs and OLAs.
Treating capacity problems as incidents only. They need planning.
Accepting provider-reported figures without checking the method.
Check yourself
What is an operational level agreement?
An internal agreement between IT teams that supports meeting the SLA.
What does capacity management use to predict future needs?
Monitoring of utilization, trend analysis and business plans.
What is a single point of failure?
A component whose failure stops the entire service.
Topic 3 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.