7.11 Supporting utilities
Information processing facilities are to be protected against power cuts and other disruption caused by failures of supporting utilities. Purpose: keep information and assets from being lost, harmed or compromised, and keep operations running, when utilities fail or are disrupted. Guidance: facilities rely on utilities such as electricity, telecommunications, water, gas, sewerage, ventilation and air conditioning, so the organization should make sure utility equipment is set up, run and maintained to manufacturers' specifications; review utilities regularly for capacity to support business growth and for how they interact with each other; inspect and test utility equipment regularly so it works properly; raise alarms to detect utility faults where needed; provide multiple feeds over physically diverse routes where needed; put networked utility equipment on a network separate from the processing facilities; and expose it to the internet only for a real need and then through a secure connection. Provide emergency lighting and communications, place emergency cut-offs for power, water, gas and other utilities near emergency exits or equipment rooms, and record emergency contact details where staff can reach them during an outage. Other information: using several routes from more than one provider adds network redundancy.
Source: ISO/IEC 27002:2022, 7.11. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Alarm and monitoring configuration for utility failures · SIEM / log platform
periodic reviewEvidence produced at each review
- Maintenance and test records for UPS, generators, HVAC and other utility equipment against manufacturer specifications · Backup / DR tooling
- Capacity reviews of power, cooling and connectivity against business growth · Physical access / facilities
governing documentDocuments that govern the control
- Diagrams showing diverse feeds and routes for power and telecommunications where required · Document repository
- Network architecture showing building management and utility systems segregated from IT networks, with controlled internet exposure · Policy repository / GRC workspace
- Emergency lighting, emergency cut-off locations and an accessible emergency contact list · Document repository
First move
Common gaps auditors find
- Generators and UPS are not load-tested regularly
- Building management systems sit on the corporate network or are reachable from the internet
- A single power or telecom feed is a single point of failure
- Cooling capacity was not reviewed after adding equipment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet