Table of Contents
ISO 27001 Supporting Utilities
The focus for this ISO 27001 Control is your utilities like power and water. As one of the ISO 27001 controls this is about protecting yourself from interruption or failure of utilities.
You will learn what the ISO 27001 control 7.11 is, how to simply and easily implement it for ISO 27001 certification and I will show you some common gotchas so you can avoid them.
What is ISO 27001 Annex A 7.11 Supporting Utilities?
ISO 27001 Annex A 7.11 Supporting Utilities is an ISO 27001 control that looks to make sure you have consider services such as power and internet connectivity and what you will do if they go down.
ISO 27001 Annex A 7.11 Purpose
The purpose of Annex A 7.11 is to prevent loss, damage or compromise of information and other associated assets, or interruption to the organisations operations due to failure and disruption of supporting utilities.
ISO 27001 Annex A 7.11 Definition
The ISO 27001 standard defines Annex A 7.11 as:
Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.
ISO 27001:2022 Annex A 7.11 Supporting Utilities
DO IT YOURSELF
ISO 27001
How to implement ISO 27001 Annex A 7.11
General Guidance
Supporting utilities are the utilities that a company provides as a service such as an electricity or gas supply. As a physical control this relates to information processing utilities such as data centres and server rooms but we can consider it in the context of end point user devices as well.
This control is really looking at availability, and the ability to continue to provide a service if the supply of power is interrupted.
To some extent this control is outside of your gift to control but there are some considerations that you can put in place and evidence.
The standard is a little overkill and for most small organisations elements of this will not apply.
Operate and Maintain Equipment
To meet the control you would, as with everything, operate any equipment that supports the utilities in line with the manufacturers guidelines. This usually means appropriate operation and professional maintenance. The professional maintenance would include testing and inspection although we would expect this to be a legal and regulatory requirement anyway, usually around health and safety.
Internet of Things (IOT)
The control raises an interesting point about not connecting support equipment to the internet if it isn’t necessary, which is a nod to the move to the internet of things (IOT).
Emergency Supporting Controls
Finally for this control is guidance on emergency supporting controls. What we mean here are things like emergency lighting, communications, cut off switches, emergency exits. As mentioned before this overkill for a small organisation and covered by your cloud provider where you have one.
The advice here is, if you have a server room or information processing facility to bring in professional third parties to advise and implement. This is not something you will undertake yourself and there are many laws that govern this that are outside your capability. Cover it in you business continuity plan on a practical side consider if you need to think about Uninterrupted Power Supplies (UPS) and alternatives for network connectivity.
ISO 27001 Templates
ISO 27001 templates have the advantage of being a massive boost that can save time and money so before we get into the implementation guide we consider these pre written templates that will sky rocket your implementation. Not interested in ISO 27001 templates, then you can skip to the next section.
How to comply with ISO 27001 Annex A 7.11
To comply with ISO 27001 Annex A 7.11 you are going to
- Get the help of a professional third party to put in place controls around supporting utilities where required.
- Have policies and procedures in place
- Assess your assets and perform a risk assessment
- Implement controls proportionate to the risk posed
- Test the controls that you have to make sure they are working
Top 3 Mistakes People Make for ISO 27001 Annex A 7.11
The top 3 mistakes people make for ISO 27001 Annex A 7.11 are
1. You have no processing facilities
If everything is in the cloud then this control is potentially irrelevant to you.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Is it include in your business continuity plan if it is relevant and have you test the plan. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Get the Help of the ISO 27001 Ninja
Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.
Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Protect | Physical Security | Protection |
| Integrity | Detect | |||