Evidence & Audit – Performance Efficiency
This page describes the evidence requirements for all WAF-PERF controls in an overview format suitable for audits.
Evidence Types
| Type | Description |
|---|---|
IaC |
Terraform code or equivalent infrastructure-as-code artifacts that prove a compliant configuration. |
Config |
Screenshots, exports, or API outputs from cloud consoles or monitoring tools. |
Governance |
Documents, policies, strategy papers, or meeting minutes that demonstrate processes and decisions. |
Process |
Evidence of regularly performed processes: reports, tickets, calendar entries, review minutes. |
Required Evidence per Control
WAF-PERF-010 – Compute Sizing
| Type | Required | Description |
|---|---|---|
Config |
✅ Required |
Sizing document or ADR section with measured CPU/memory baselines and instance type justification. |
IaC |
✅ Required |
Terraform configuration with current instance generation and explicit size declaration. |
Process |
Optional |
Quarterly report on sizing reviews with a list of over/under-provisioned resources. |
Config |
Optional |
Export from AWS Compute Optimizer, Azure Advisor, or GCP Recommender. |
WAF-PERF-020 – Auto-Scaling
| Type | Required | Description |
|---|---|---|
IaC |
✅ Required |
Auto-scaling configuration with min/desired/max and scaling policy. |
Process |
✅ Required |
Load test results demonstrating that auto-scaling triggers within the latency SLO. |
Config |
Optional |
CloudWatch/Azure Monitor/GCP monitoring alerts for scaling events. |
Governance |
Optional |
Runbook with documented scaling limits and known bottlenecks. |
WAF-PERF-030 – Caching
| Type | Required | Description |
|---|---|---|
Governance |
✅ Required |
Caching strategy document with layer definition, TTL policies, and invalidation mechanism. |
IaC |
✅ Required |
Terraform configuration for ElastiCache/Azure Redis/Memorystore and CDN with cache rules. |
Config |
Optional |
Cache hit rate dashboard with target achievement evidence (>= 80% application cache). |
Process |
Optional |
Cache invalidation runbook for data mutations. |
WAF-PERF-040 – Database Performance
| Type | Required | Description |
|---|---|---|
Config |
✅ Required |
Performance Insights or slow query log configuration (active on production databases). |
Governance |
✅ Required |
Index strategy document for high-frequency queries. |
Process |
Optional |
Monthly slow query review report with action items. |
Config |
Optional |
Query performance baseline (P50/P95/P99 for the top-20 queries). |
WAF-PERF-050 – SLOs & Monitoring
| Type | Required | Description |
|---|---|---|
Governance |
✅ Required |
SLO document for all production services (SLI definition, SLO targets, error budget policy). |
Config |
✅ Required |
Monitoring/APM configuration with SLI instrumentation and SLO alerting rules. |
Config |
Optional |
SLO compliance dashboard with historical trends and current error budget status. |
Process |
Optional |
Quarterly SLO review report with adjustments. |
WAF-PERF-060 – Load Tests
| Type | Required | Description |
|---|---|---|
IaC / Code |
✅ Required |
Load test scripts (k6/Gatling/Locust) with explicit acceptance criteria in version control. |
Process |
✅ Required |
CI/CD pipeline configuration with load test as deployment gate. |
Config |
Optional |
Historical load test results across multiple releases as regression baseline. |
Governance |
Optional |
Performance test strategy document with scenarios, acceptance criteria, and execution cadence. |
WAF-PERF-070 – Network Performance
| Type | Required | Description |
|---|---|---|
IaC |
✅ Required |
Terraform configuration with CDN and VPC/Private endpoints for cloud service access. |
Governance |
✅ Required |
Network topology diagram with service placement, AZ distribution, and traffic routing. |
Config |
Optional |
Network latency baselines (service-to-service RTT by AZ combination). |
Process |
Optional |
CDN cache hit rate report. |
WAF-PERF-080 – Serverless & Managed Services
| Type | Required | Description |
|---|---|---|
IaC |
✅ Required |
Terraform configuration for Lambda/functions with explicit memory, timeout, and concurrency. |
Governance |
✅ Required |
Documentation of the serverless adoption rationale for variable workloads. |
Config |
Optional |
Lambda Power Tuning results or equivalent memory optimization analysis. |
Process |
Optional |
Cost comparison serverless vs. EC2/container for spike workloads. |
WAF-PERF-090 – Storage I/O
| Type | Required | Description |
|---|---|---|
IaC |
✅ Required |
Terraform configuration with explicit storage type, IOPS, and throughput settings. |
Config |
✅ Required |
Monitoring configuration for storage I/O alerts (queue depth, throughput, burst balance). |
Process |
Optional |
Storage I/O baseline with P95/P99 queue depth and throughput utilization. |
Governance |
Optional |
Storage tier selection guidelines by workload type. |
WAF-PERF-100 – Performance Debt Register
| Type | Required | Description |
|---|---|---|
Governance |
✅ Required |
Performance debt register with all required fields (ID, description, impact, owner, priority). |
Process |
✅ Required |
Quarterly review meeting minutes or calendar with evidence of regular reviews. |
Process |
Optional |
Sprint/backlog entries with prioritized performance debt tickets. |
Config |
Optional |
Dashboard with performance debt metrics (open entries, age distribution, paydown rate). |
Audit Checklist (Short Form)
For a quick audit overview, the following checklist can be used:
-
Sizing documentation for all production compute resources present
-
Auto-scaling configuration in IaC with min/max and scaling policy
-
Load test result as evidence of validated auto-scaling present
-
Caching strategy document created and current
-
Performance Insights or equivalent DB monitoring active
-
SLO document for all critical services present
-
CI/CD pipeline with load test gate configured
-
CDN and VPC endpoints configured in IaC
-
Lambda/functions configuration with explicit memory and timeout
-
gp3 or equivalent optimal storage types used
-
Performance debt register maintained and current
-
Quarterly review evidence present