The ultimate how to implement guide to ISO 27001 Annex A 7.11 Supporting Utilities.
Table of contents
- 1. Map All Critical Utility Dependencies
- 2. Install Uninterruptible Power Supply (UPS) Systems
- 3. Deploy Redundant Power Feeds
- 4. Configure Backup Power Generators
- 5. Implement Redundant HVAC (Cooling) Systems
- 6. Secure Utility Entry Points and Routing
- 7. Integrate Environmental Monitoring Alerts
- 8. Conduct Monthly Load Bank and ATS Testing
- 9. Schedule Preventive Utility Maintenance
- 10. Establish Emergency Shut-off Procedures
1. Map All Critical Utility Dependencies
Control Requirement: Identify all supporting utilities necessary for the operation of information processing facilities.
Required Implementation Step: Physically trace and document all utility entry points to the building, including electricity feeders, water mains, and telecommunications conduits. Create a “Utility Dependency Map” that shows which server racks or cooling units are served by which specific breaker panels or pipework.
Minimum Requirement: A technical diagram or spreadsheet listing every critical utility and its specific business impact if lost.
2. Install Uninterruptible Power Supply (UPS) Systems
Control Requirement: Provide protection against power failures.
Required Implementation Step: Deploy UPS hardware with sufficient capacity to maintain the load of all critical servers and network switches for at least 20 minutes. Configure the UPS to send an automated “low battery” signal to the OS to trigger a graceful shutdown of databases before the power is exhausted.
Minimum Requirement: Verified UPS capacity that exceeds the peak power draw of the server room.
3. Deploy Redundant Power Feeds
Control Requirement: Minimise the risk of single points of failure in power delivery.
Required Implementation Step: Use Power Distribution Units (PDUs) with dual power inputs (A and B feeds). Connect these to separate circuit breakers or, ideally, separate utility providers to ensure that a single tripped breaker doesn’t take down an entire rack of dual-power-supply servers.
Minimum Requirement: Photographic evidence of dual power cabling in the server racks.
4. Configure Backup Power Generators
Control Requirement: Maintain utility continuity during prolonged outages.
Required Implementation Step: Install an on-site diesel or gas generator with an Automatic Transfer Switch (ATS). Ensure the fuel tank is kept at least 75% full at all times and that you have a signed contract with a local fuel supplier for emergency priority delivery within 4 hours.
Minimum Requirement: A generator capable of running the entire IT load and cooling indefinitely with refuelling.
5. Implement Redundant HVAC (Cooling) Systems
Control Requirement: Protect information processing facilities from environmental failure (heat).
Required Implementation Step: Deploy cooling in an N+1 configuration. If one air conditioning unit fails, the remaining unit(s) must be physically capable of maintaining a temperature below 24°C under full server load without manual intervention.
Minimum Requirement: Technical specification of the cooling units proving N+1 redundancy.
6. Secure Utility Entry Points and Routing
Control Requirement: Protect utility lines from physical damage or interference.
Required Implementation Step: Enclose all external cabling and pipework in grounded steel conduit. Ensure that the primary power transformer and water shut-off valves are located within the secure perimeter or inside a locked, alarmed enclosure to prevent malicious sabotage.
Minimum Requirement: Physical inspection showing no exposed utility lines in public or unsecured areas.
7. Integrate Environmental Monitoring Alerts
Control Requirement: Detect utility failures in real-time.
Required Implementation Step: Install networked sensors for temperature, humidity, and water leaks. Configure these to send SNMP or SMS alerts to the IT team immediately upon a threshold breach, rather than waiting for a dashboard to be manually checked.
Minimum Requirement: Active environmental sensors reporting to an automated alerting system.
8. Conduct Monthly Load Bank and ATS Testing
Control Requirement: Regularly test the effectiveness of backup utilities.
Required Implementation Step: Perform a monthly “pull the plug” test where you manually trigger the ATS to move the load to the generator. Run the generator under load for at least 60 minutes to verify that the cooling and power remain stable and no breakers trip.
Minimum Requirement: A signed logbook of monthly successful generator and ATS failover tests.
9. Schedule Preventive Utility Maintenance
Control Requirement: Ensure utilities are maintained according to manufacturer specifications.
Required Implementation Step: Contract a certified engineer to service the UPS batteries, generator, and HVAC systems at least twice a year. Retain the physical service reports as evidence, ensuring they note the specific health of batteries and filters.
Minimum Requirement: Current maintenance certificates for all critical supporting infrastructure.
10. Establish Emergency Shut-off Procedures
Control Requirement: Provide the ability to isolate utilities in an emergency.
Required Implementation Step: Clearly label every emergency power-off (EPO) button and water shut-off valve. Create a physical “Emergency Utility Manual” and place it in a red box by the server room door so that any staff member can isolate the equipment in the event of a fire or flood.
Minimum Requirement: Visible, labelled isolation points and a documented emergency procedure.
About the author
