# PLT-006: Scale enforcement and telemetry to the full population


- Area: Platform, Privacy & Assurance

- Verification: Documentation + Proof of value
- OWASP adoption tier: AT2, AT4, AT6
- Formerly: ARC-007
- URL: /r/PLT-006

**Acceptance criteria:** Demonstrate capacity, latency and availability, and dashboard, drill-down, search and export performance, at the target scale.

**Why it matters:** A control proven at a few thousand users can behave like a different product at full scale.

**How to verify:** The vendor provides a reference at your scale and demonstrates console performance on pilot data.

**OWASP adoption context:** Population-scale capacity and availability matter across adoption tiers, with the actual workload and deployment determining the test conditions.

**Mappings:**
- NIST CSF 2.0: PR.IR-04; SOC 2: A1.1; ISO 27001: Cl. 9.1, A.8.6 — Recorded capacity, latency and availability at the target population provide resource-adequacy and security-control performance evidence, including availability planning where the SOC 2 Availability category and relevant information are in scope. A benchmark does not establish ongoing capacity monitoring or resilience under all loads; the user-count target is buyer-specific.
ISO/IEC 27001: Define responsibility, frequency and evaluation for security-performance or control-effectiveness measures. Test sustained load and spare capacity; a demonstration does not establish ongoing monitoring or adjustment, and ISO prescribes no particular latency.
- NIST AI RMF: MEASURE 2.3 — Recorded performance tests at deployment-like scale provide measurement evidence and clarify the conditions in which results apply. The buyer must judge whether those conditions represent production use.
- ISO 42001: A.4.5 — Population-scale results inform computing-resource needs for enforcement and telemetry. The target user count is a buyer criterion, and a demonstration does not by itself establish continuing resource adequacy.