Table of Contents
ISO 27001 Supporting Utilities
I am going to show you what ISO 27001 Annex A 7.11 Supporting Utilities is, what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it.
What is ISO 27001 Annex A 7.11?
ISO 27001 Annex A 7.11 Supporting Utilities is an ISO 27001 control that looks to make sure you have consider services such as power and internet connectivity and what you will do if they go down.
The focus for this ISO 27001 Control is your utilities like power and water. This is about protecting yourself from interruption or failure of utilities.
ISO 27001 Annex A 7.11 Purpose
The purpose of ISO 27001 Annex A 7.11 Supporting Utilities is to prevent loss, damage or compromise of information and other associated assets, or interruption to the organisations operations due to failure and disruption of supporting utilities.
ISO 27001 Annex A 7.11 Definition
The ISO 27001 standard defines Supporting Utilities as:
Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.
ISO 27001:2022 Annex A 7.11 Supporting Utilities

Implementation Guide
General Guidance
Supporting utilities are the utilities that a company provides as a service such as an electricity or gas supply. As a physical control this relates to information processing utilities such as data centres and server rooms but we can consider it in the context of end point user devices as well.
This control is really looking at availability, and the ability to continue to provide a service if the supply of power is interrupted.
To some extent this control is outside of your gift to control but there are some considerations that you can put in place and evidence.
The standard is a little overkill and for most small organisations elements of this will not apply.
Operate and Maintain Equipment
To meet the control you would, as with everything, operate any equipment that supports the utilities in line with the manufacturers guidelines. This usually means appropriate operation and professional maintenance. The professional maintenance would include testing and inspection although we would expect this to be a legal and regulatory requirement anyway, usually around health and safety.
Internet of Things (IOT)
The control raises an interesting point about not connecting support equipment to the internet if it isn’t necessary, which is a nod to the move to the internet of things (IOT).
Emergency Supporting Controls
Finally for this control is guidance on emergency supporting controls. What we mean here are things like emergency lighting, communications, cut off switches, emergency exits. As mentioned before this overkill for a small organisation and covered by your cloud provider where you have one.
The advice here is, if you have a server room or information processing facility to bring in professional third parties to advise and implement. This is not something you will undertake yourself and there are many laws that govern this that are outside your capability. Cover it in you business continuity plan on a practical side consider if you need to think about Uninterrupted Power Supplies (UPS) and alternatives for network connectivity.
Watch the tutorial
Watch the ISO 27001 tutorial on supporting utilities.
How to pass the audit
To comply with ISO 27001 Annex A 7.11 Supporting Utilities you are going to
- Get the help of a professional third party to put in place controls around supporting utilities where required.
- Have policies and procedures in place
- Assess your assets and perform a risk assessment
- Implement controls proportionate to the risk posed
- Test the controls that you have to make sure they are working
Top 3 Mistakes People Make
The top 3 mistakes people make for ISO 27001 Annex A 7.11 Supporting Utilities are
1. You have no processing facilities
If everything is in the cloud then this control is potentially irrelevant to you.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Is it include in your business continuity plan if it is relevant and have you test the plan. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 7.11 Attribute Table
Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
---|---|---|---|---|
Preventive | Availability | Protect | Physical Security | Protection |
Integrity | Detect | |||