Table of Contents
ISO 27001 Supporting Utilities
ISO 27001 Annex A 7.11 Supporting Utilities is an ISO 27001 control that looks to make sure you have consider services such as power and internet connectivity and what you will do if they go down.
The focus for this ISO 27001 Control is your utilities like power and water. As one of the ISO 27001 controls this is about protecting yourself from interruption or failure of utilities.
ISO 27001 Annex A 7.11 Purpose
The purpose of ISO 27001 Annex A 7.11 Supporting Utilities is to prevent loss, damage or compromise of information and other associated assets, or interruption to the organisations operations due to failure and disruption of supporting utilities.
ISO 27001 Annex A 7.11 Definition
The ISO 27001 standard defines Supporting Utilities as:
Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.
ISO 27001:2022 Annex A 7.11 Supporting Utilities
Watch the tutorial
In the video ISO 27001 Supporting Utilities Explained – ISO27001:2022 Annex A 7.11 I show you how to implement it and how to pass the audit.
How to implement ISO 27001 Annex A 7.11
General Guidance
Supporting utilities are the utilities that a company provides as a service such as an electricity or gas supply. As a physical control this relates to information processing utilities such as data centres and server rooms but we can consider it in the context of end point user devices as well.
This control is really looking at availability, and the ability to continue to provide a service if the supply of power is interrupted.
To some extent this control is outside of your gift to control but there are some considerations that you can put in place and evidence.
The standard is a little overkill and for most small organisations elements of this will not apply.
Operate and Maintain Equipment
To meet the control you would, as with everything, operate any equipment that supports the utilities in line with the manufacturers guidelines. This usually means appropriate operation and professional maintenance. The professional maintenance would include testing and inspection although we would expect this to be a legal and regulatory requirement anyway, usually around health and safety.
Internet of Things (IOT)
The control raises an interesting point about not connecting support equipment to the internet if it isn’t necessary, which is a nod to the move to the internet of things (IOT).
Emergency Supporting Controls
Finally for this control is guidance on emergency supporting controls. What we mean here are things like emergency lighting, communications, cut off switches, emergency exits. As mentioned before this overkill for a small organisation and covered by your cloud provider where you have one.
The advice here is, if you have a server room or information processing facility to bring in professional third parties to advise and implement. This is not something you will undertake yourself and there are many laws that govern this that are outside your capability. Cover it in you business continuity plan on a practical side consider if you need to think about Uninterrupted Power Supplies (UPS) and alternatives for network connectivity.
How to comply
To comply with ISO 27001 Annex A 7.11 Supporting Utilities you are going to
- Get the help of a professional third party to put in place controls around supporting utilities where required.
- Have policies and procedures in place
- Assess your assets and perform a risk assessment
- Implement controls proportionate to the risk posed
- Test the controls that you have to make sure they are working
Top 3 Mistakes People Make
The top 3 mistakes people make for ISO 27001 Annex A 7.11 Supporting Utilities are
1. You have no processing facilities
If everything is in the cloud then this control is potentially irrelevant to you.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Is it include in your business continuity plan if it is relevant and have you test the plan. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Related ISO 27001 Controls
ISO 27001 Use of Privileged Utility Programs: Annex A 8.18
ISO 27001 Equipment Siting And Protection: Annex A 7.8
ISO 27001 Securing Offices, Rooms And Facilities: Annex A 7.3
ISO 27001 Equipment Maintenance: Annex A 7.13
ISO 27001 Documented Operating Procedures: Annex A 5.37
Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Protect | Physical Security | Protection |
| Integrity | Detect | |||
