ISO 27001:2022 Annex A 7.11 Supporting utilities

In this guide, I will show you exactly how to implement ISO 27001 Annex A 7.11 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 7.11 Supporting Utilities

ISO 27001 Annex A 7.11 requires organizations to protect their information processing facilities from power failures and other disruptions caused by the failure of supporting utilities (e.g., electricity, internet, water, and cooling). The goal is to ensure Availability, if the power goes out or the internet line is cut, your business operations should either continue via backups or shut down gracefully without data loss.

Core requirements for compliance include:

• Redundancy for Critical Utilities: You must identify which utilities are vital to your operations and implement backups. This commonly includes Uninterruptible Power Supplies (UPS) for servers and secondary internet connections (e.g., 4G/5G failover).
• Graceful Shutdown Procedures: If backups are limited (like a 15-minute UPS battery), you must have a documented process to automatically or manually shut down systems before they crash and corrupt data.
• Maintenance of Support Equipment: It’s not enough to have a generator or UPS; you must follow manufacturer guidelines for maintenance and testing. An auditor will want to see that your backup battery actually holds a charge.
• Environmental Controls: Utility management includes HVAC (Heating, Ventilation, and Air Conditioning). If your server room cooling fails, you must have a plan to prevent hardware damage from overheating.
• Physical Safety: This control also covers emergency utilities like fire alarms, emergency lighting, and water supply (for staff welfare/sanitation), ensuring the facility remains safe and operational.

Audit Focus: Auditors will look for “The Failover Proof”:

1. Maintenance Records: “Show me the last service report for your server room air conditioning and UPS units.”
2. Continuity Testing: “When was the last time you tested your internet failover? Did it switch to the backup line automatically?”
3. Emergency Awareness: They may look for physical evidence of emergency lighting and correctly maintained fire extinguishers.

Utility Failure Response Matrix (Audit Cheat Sheet):

Utility	Primary Backup	Secondary Backup	Action Plan
Electricity	UPS Battery (15-30 min).	Diesel Generator.	Automated graceful shutdown if UPS hits 10%.
Internet	4G / 5G Failover.	Secondary ISP Line.	Automatic routing of traffic to the backup line.
Cooling	Portable A/C Units.	Emergency venting.	Power down non-critical servers if temp > 30°C.
Water	Bottled Water (Staff).	N/A.	Close the office if sanitation/toilets fail.

What is ISO 27001 Annex A 7.11?

The focus for this ISO 27001 Control is your utilities like power and water. As one of the ISO 27001 controls this is about protecting yourself from interruption or failure of utilities.

ISO 27001 Annex A 7.11 Supporting Utilities is an ISO 27001 control that looks to make sure you have consider services such as power and internet connectivity and what you will do if they go down.

ISO 27001 Annex A 7.11 Purpose

The purpose of ISO 27001 Annex A 7.11 Supporting Utilities is to prevent loss, damage or compromise of information and other associated assets, or interruption to the organisations operations due to failure and disruption of supporting utilities.

ISO 27001 Annex A 7.11 Definition

The ISO 27001 standard defines Supporting Utilities as:

Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.

ISO 27001:2022 Annex A 7.11 Supporting Utilities

ISO 27001 Annex A 7.11 Free Training Video

In the video ISO 27001 Supporting Utilities Explained – ISO27001:2022 Annex A 7.11 I show you how to implement it and how to pass the audit.

ISO 27001 Annex A 7.11 Explainer Video

In this beginner’s guide to ISO 27001 Annex A 7.11 Supporting Utilities, ISO 27001 Lead Auditor Stuart Barker and his team talk you through what it is, how to implement in and how to pass the audit. Free ISO 27001 training.

ISO 27001 Annex A 7.11 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 7.11 Supporting Utilities. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 7.11

General Guidance

Supporting utilities are the utilities that a company provides as a service such as an electricity or gas supply. As a physical control this relates to information processing utilities such as data centres and server rooms but we can consider it in the context of end point user devices as well.

This control is really looking at availability, and the ability to continue to provide a service if the supply of power is interrupted.

To some extent this control is outside of your gift to control but there are some considerations that you can put in place and evidence.

The standard is a little overkill and for most small organisations elements of this will not apply.

Operate and Maintain Equipment

To meet the control you would, as with everything, operate any equipment that supports the utilities in line with the manufacturers guidelines. This usually means appropriate operation and professional maintenance. The professional maintenance would include testing and inspection although we would expect this to be a legal and regulatory requirement anyway, usually around health and safety.

Internet of Things (IOT)

The control raises an interesting point about not connecting support equipment to the internet if it isn’t necessary, which is a nod to the move to the internet of things (IOT).

Emergency Supporting Controls

Finally for this control is guidance on emergency supporting controls. What we mean here are things like emergency lighting, communications, cut off switches, emergency exits. As mentioned before this overkill for a small organisation and covered by your cloud provider where you have one.

The advice here is, if you have a server room or information processing facility to bring in professional third parties to advise and implement. This is not something you will undertake yourself and there are many laws that govern this that are outside your capability. Cover it in you business continuity plan on a practical side consider if you need to think about Uninterrupted Power Supplies (UPS) and alternatives for network connectivity.

Utility Failure Response

Utility	Primary Backup	Secondary Backup	Action Plan
Electricity	UPS Battery (15 mins)	Diesel Generator (24 hours)	Graceful shutdown if gen fails.
Internet	4G/5G Failover	Second ISP Line	Route traffic to backup line.
Cooling (HVAC)	Portable A/C Units	Open Doors/Fans	Shut down non-critical servers.
Water	Bottled Water (Staff)	N/A (Servers don’t drink)	Close office if toilets fail.

How to comply

To comply with ISO 27001 Annex A 7.11 Supporting Utilities you are going to

• Get the help of a professional third party to put in place controls around supporting utilities where required.
• Have policies and procedures in place
• Assess your assets and perform a risk assessment
• Implement controls proportionate to the risk posed
• Test the controls that you have to make sure they are working

Top 3 ISO 27001 Annex A 7.11 mistakes and how to avoid them

The top 3 mistakes people make for ISO 27001 Annex A 7.11 Supporting Utilities are

1. You have no processing facilities

If everything is in the cloud then this control is potentially irrelevant to you.

2. One or more members of your team haven’t done what they should have done

Prior to the audit check that all members of the team have done what they should have. Is it include in your business continuity plan if it is relevant and have you test the plan. Check!

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Fast Track Compliance with the ISO 27001 Toolkit

---

---

For ISO 27001 Annex A 7.11 (Supporting utilities), the requirement is to protect information processing facilities from power failures and other disruptions (like internet or water). This is a purely physical and operational availability control.

While SaaS compliance platforms often try to sell you “automated utility monitoring” or complex business continuity modules, they cannot actually plug in a UPS or switch on a diesel generator, they are merely a place to host your documentation. The High Table ISO 27001 Toolkit is the logical choice because it provides the governance layer that defines these rules, allowing you to manage your utility resilience effectively without a recurring subscription fee.

1. Ownership: You Own Your Utility Strategy Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your backup power rules and store your utility failure response plans inside their proprietary system, you are essentially renting your own resilience strategy.

• The Toolkit Advantage: You receive the Business Continuity Plan and Utility Failure Response templates in standard Word/Excel formats. These are yours forever. You maintain permanent ownership of your standards (such as 4G/5G failover protocols), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World Infrastructure

Annex A 7.11 is about ensuring availability through physical utilities. You don’t need a complex new software interface to manage what your facility managers or cloud providers (who already handle this for you) do.

• The Toolkit Advantage: Your team already knows what to do if the power goes out. What they need is the governance layer to prove to an auditor that these actions are planned, tested, and documented. The Toolkit provides pre-written policies and “Utility Failure Response” guides that formalize your existing infrastructure work into an auditor-ready framework, without forcing your team to learn a new software platform.

3. Cost: A One-Off Fee vs. The “Physical Facility” Tax

Many compliance SaaS platforms charge based on the number of “locations” or “critical assets” you track. For a control that applies to every office and server room, these monthly costs can scale aggressively.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you have one small office or a global network of data centers, the cost of your Supporting Utilities Documentation remains the same. You save your budget for actual UPS batteries and backup internet lines rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Resilience Strategy

SaaS tools often only integrate with a limited number of “standard” facilities management systems. If you use specialized local providers or change your office setup, the SaaS tool can become a barrier to operational flexibility.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can edit the Response Procedures to match any environment, on-premise, remote work, or third-party facilities. You maintain total freedom to choose the best utility providers for your business without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 7.11, the auditor wants to see that you have a plan for utility failures and proof that it is integrated into your business continuity strategy. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

Related ISO 27001 Controls

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001 Annex A 7.8 Equipment Siting And Protection

ISO 27001 Annex A 7.3 Securing Offices, Rooms And Facilities

ISO 27001 Annex A 7.13 Equipment Maintenance

ISO 27001 Annex A 5.37 Documented Operating Procedures

Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Availability	Protect	Physical Security	Protection
	Integrity	Detect

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.