Acceptance criteria
Demonstrate capacity, latency and availability, and dashboard, drill-down, search and export performance, at the target scale.
Why it matters
A control proven at a few thousand users can behave like a different product at full scale.
How to verify
The vendor provides a reference at your scale and demonstrates console performance on pilot data.
OWASP adoption context
Population-scale capacity and availability matter across adoption tiers, with the actual workload and deployment determining the test conditions.
Framework mappings
Recorded capacity, latency and availability at the target population provide resource-adequacy and security-control performance evidence, including availability planning where the SOC 2 Availability category and relevant information are in scope. A benchmark does not establish ongoing capacity monitoring or resilience under all loads; the user-count target is buyer-specific. ISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures. Test sustained load and spare capacity; a demonstration does not establish ongoing monitoring or adjustment, and ISO prescribes no particular latency.
Recorded performance tests at deployment-like scale provide measurement evidence and clarify the conditions in which results apply. The buyer must judge whether those conditions represent production use.
Population-scale results inform computing-resource needs for enforcement and telemetry. The target user count is a buyer criterion, and a demonstration does not by itself establish continuing resource adequacy.