{"id":"PLT-006","section":"Platform, Privacy & Assurance","requirement":"Scale enforcement and telemetry to the full population","acceptance":"Demonstrate capacity, latency and availability, and dashboard, drill-down, search and export performance, at the target scale.","tier":"AT2, AT4, AT6","whyItMatters":"A control proven at a few thousand users can behave like a different product at full scale.","verificationMethod":"D + POV","verificationTest":"The vendor provides a reference at your scale and demonstrates console performance on pilot data.","formerly":"ARC-007","alsoIn":[],"sort":60,"adoptionContext":"Population-scale capacity and availability matter across adoption tiers, with the actual workload and deployment determining the test conditions.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Recorded capacity, latency and availability at the target population provide resource-adequacy and security-control performance evidence, including availability planning where the SOC 2 Availability category and relevant information are in scope. A benchmark does not establish ongoing capacity monitoring or resilience under all loads; the user-count target is buyer-specific.\nISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures. Test sustained load and spare capacity; a demonstration does not establish ongoing monitoring or adjustment, and ISO prescribes no particular latency.","kind":"framework","references":{"csf":["PR.IR-04"],"soc2":["A1.1"],"iso27001":["Cl. 9.1","A.8.6"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Recorded performance tests at deployment-like scale provide measurement evidence and clarify the conditions in which results apply. The buyer must judge whether those conditions represent production use.","kind":"framework","references":{"rmf":["MEASURE 2.3"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Population-scale results inform computing-resource needs for enforcement and telemetry. The target user count is a buyer criterion, and a demonstration does not by itself establish continuing resource adequacy.","kind":"framework","references":{"iso":["A.4.5"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-006","frameworkRefs":{"ISO27001":["Cl. 9.1","A.8.6"],"ISO42001":["A.4.5"],"NIST-CSF":["PR.IR-04"],"NIST-AI-RMF":["MEASURE 2.3"],"SOC2":["A1.1"]}}