ISO 27001 A.7.11 - Supporting Utilities

Requirement

“Information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.”

Plain-language meaning

Information processing facilities need supporting utilities to operate. Electricity, cooling, ventilation, telecommunications, water, fire protection, emergency lighting, and building management systems can all affect availability.

The organization should identify which utilities are required, test and inspect them, monitor for failures, and provide redundancy where risk and business continuity requirements justify it.

Why this matters

No utility usually means no availability. A server room without cooling can fail quickly. A power failure without UPS or generator capacity can shut down critical services. Loss of water may close a site even if computers still work. A failed telecommunications link can make a service unavailable even when the facility itself is fine.

Implementation guidance

1. Identify required supporting utilities

Typical utilities include:

• electricity;
• heating, ventilation, and air conditioning;
• telecommunications and network connectivity;
• clean running water;
• fire protection systems;
• emergency lighting;
• fuel for generators;
• building management systems;
• environmental monitoring systems.

2. Link utility needs to business requirements

Use Risk Assessment and A.5.30 ICT Readiness for Business Continuity to decide where redundancy is needed.

3. Provide resilience where required

Controls may include:

• uninterruptible power supply;
• standby generator;
• redundant power feeds;
• redundant telecommunications links;
• power conditioning for sensitive equipment;
• environmental alarms;
• emergency lighting;
• HVAC redundancy;
• generator fuel management;
• maintenance contracts and supplier agreements.

UPS/generator capacity should cover the required operating period or the time defined in continuity requirements. It should also include dependent loads such as cooling, not only servers.

4. Inspect, test, and maintain utilities

Utilities should be inspected and tested regularly.

Testing should verify:

• UPS runtime and battery condition;
• generator start and load capacity;
• fuel availability;
• HVAC capacity and alarm response;
• telecommunications failover;
• emergency lighting;
• fire protection supply;
• environmental alarm operation;
• maintenance completion.

5. Treat in-scope building management systems as IT systems

If building management systems are in ISMS scope, they should receive appropriate IT/security controls such as malware protection, backups, vulnerability management, access control, logging, and audit.

Audit guidance

Auditors should verify:

• supporting utilities are identified;
• critical facilities have mapped utility dependencies;
• required utility service levels are documented;
• external utility/provider agreements are considered where relevant;
• utilities are inspected, tested, and maintained;
• UPS/generator capacity matches documented requirements;
• cooling requirements are included in power resilience planning;
• alarms detect utility failures;
• emergency lighting is available where needed;
• redundant utility connections are implemented or risk-assessed as not required;
• building management systems in scope are treated as IT systems.

Audit testing should include reviewing records and asking how the organization knows the selected utility resilience is sufficient.

Evidence examples

Strong evidence

• Utility dependencies are mapped to critical information processing facilities.
• UPS/generator tests include load, runtime, and cooling requirements.
• Maintenance follows manufacturer recommendations.
• Alarms detect utility failures and have response procedures.
• Redundant links or feeds are implemented where justified.
• Continuity requirements define required operating duration.
• Building management systems in scope have backups, access controls, patching, and monitoring.

Weak evidence

• UPS exists but runtime has not been tested.
• Generator exists but cooling load is excluded.
• Utility inspection records are missing.
• Telecommunications resilience is assumed but not tested.
• Alarms exist but no one knows who responds.
• BMS is networked but not patched, backed up, or audited.
• Continuity plan assumes power availability without evidence.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.5 Protecting Against Physical and Environmental Threats
• A.7.8 Equipment Siting and Protection
• A.5.29 Information Security During Disruption
• A.5.30 ICT Readiness for Business Continuity
• Risk Assessment
• Statement of Applicability
• Supporting Utility Dependency Register
• Supporting Utility Inspection and Test Log
• UPS and Generator Capacity Test Record
• Building Management System Security Review
• A.7.11 Audit Evidence Pack
• A.7.11 Audit Checklist

KB-ready summary

• Identify required utilities.
• Map utilities to critical facilities and services.
• Test UPS, generators, cooling, telecoms, emergency lighting, and alarms.
• Include cooling and dependent loads in power calculations.
• Treat in-scope building management systems like IT systems.
• Audit for tested capacity, not just installed equipment.

Templates and checklists

• Supporting Utility Dependency Register
• Supporting Utility Inspection and Test Log
• UPS and Generator Capacity Test Record
• Building Management System Security Review
• A.7.11 Audit Checklist