Supporting utilities

What the control asks

Information processing facilities are to be protected against power cuts and other disruption caused by failures of supporting utilities. Purpose: keep information and assets from being lost, harmed or compromised, and keep operations running, when utilities fail or are disrupted. Guidance: facilities rely on utilities such as electricity, telecommunications, water, gas, sewerage, ventilation and air conditioning, so the organization should make sure utility equipment is set up, run and maintained to manufacturers' specifications; review utilities regularly for capacity to support business growth and for how they interact with each other; inspect and test utility equipment regularly so it works properly; raise alarms to detect utility faults where needed; provide multiple feeds over physically diverse routes where needed; put networked utility equipment on a network separate from the processing facilities; and expose it to the internet only for a real need and then through a secure connection. Provide emergency lighting and communications, place emergency cut-offs for power, water, gas and other utilities near emergency exits or equipment rooms, and record emergency contact details where staff can reach them during an outage. Other information: using several routes from more than one provider adds network redundancy.

Purpose in the standard’s terms, in our words: Prevents loss, compromise or interruption of operations caused by failure of supporting utilities.

Attribute values in one line: Preventive, Detective; Integrity, Availability; Protect, Detect; Physical security; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Maintenance and test records for UPS, generators, HVAC and other utility equipment against manufacturer specifications
• Capacity reviews of power, cooling and connectivity against business growth
• Alarm and monitoring configuration for utility failures
• Diagrams showing diverse feeds and routes for power and telecommunications where required
• Network architecture showing building management and utility systems segregated from IT networks, with controlled internet exposure
• Emergency lighting, emergency cut-off locations and an accessible emergency contact list

Where audits commonly find gaps

• Generators and UPS are not load-tested regularly
• Building management systems sit on the corporate network or are reachable from the internet
• A single power or telecom feed is a single point of failure
• Cooling capacity was not reviewed after adding equipment

What ISO/IEC 27028 changes for this control

It carries more than one control type (preventive, detective), so the register should record each and the evidence that proves each one operates. Its earlier numbering (11.2.2) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 7.4 Physical security monitoring
• 7.1 Physical security perimeters
• 7.10 Storage media

Read the five attributes All 93 controls