Supporting Utilities
Plain English Translation
ISO 27001 Annex A.7.11 requires the organization to protect its information processing facilities against power failures and other utility disruptions, such as water, gas, or telecommunications outages. This involves implementing backups like uninterruptible power supplies (UPS) and generators, and maintaining redundant internet connections to ensure systems stay online or shut down safely during an unexpected outage.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Host primary infrastructure in top-tier cloud environments (e.g., AWS, Azure) to inherit enterprise-grade utility redundancy.
- Use basic surge protectors and UPS devices for critical on-premise networking equipment like firewalls and routers.
Required Actions (scaleup)
- Implement redundant telecommunications links (dual ISPs) for critical office locations to prevent single points of failure.
- Define utility outage response procedures within the broader Business Continuity and Disaster Recovery (BCDR) plan.
Required Actions (enterprise)
- Deploy N+1 power redundancy for data centers, including dual power feeds, large-scale UPS arrays, and onsite diesel generators.
- Continuously monitor power quality and HVAC status using automated environmental sensors linked to the Security Operations Center (SOC).
It is a physical security control requiring the organization to protect its information processing facilities from power failures and disruptions caused by failures in supporting utilities like telecommunications, water, and gas.
Supporting utilities include electricity, telecommunications (internet), water supply, gas, sewage, and HVAC (heating, ventilation, and air conditioning) systems required to keep infrastructure running safely.
Organizations implement this by installing Uninterruptible Power Supplies (UPS) for immediate failover, backup generators for prolonged outages, redundant internet service providers, and adequate HVAC systems to prevent overheating.
If the organization hosts critical infrastructure on-premise, a UPS and backup power source like a generator are highly expected. However, if infrastructure is hosted entirely in the cloud, these physical controls are delegated to the cloud provider.
Auditors look for an approved Physical Security Policy, maintenance logs for UPS and generator testing, environmental monitoring alerts, and compliance certificates (like SOC 2) from third-party data centers as ISO 27001 supporting utilities audit evidence.
Backup power systems should be tested and maintained at planned intervals governed by a backup generator testing and maintenance policy, typically requiring monthly tests and annual comprehensive maintenance.
For cloud-hosted environments, the organization satisfies this control by verifying their provider's utility redundancy through a formal vendor security review and collecting independent audit reports like ISO 27001 or SOC 2 Type II certificates.
Organizations should evaluate the likelihood and impact of utility failures within a utility outage risk assessment for information processing facilities, identifying potential downtime costs and mapping them to appropriate redundancy and BCDR controls.
Monitoring power failures and utility outages requires utilizing environmental monitoring tools that automatically alert operations teams in the event of a power drop, temperature spike, or switch to battery power, enabling a rapid incident response.
Common nonconformities include failing to regularly test UPS batteries, neglecting to secure redundant internet connections for critical offices, and lacking vendor compliance evidence for outsourced cloud data centers.
A.7.11 typically requires you to track policies, vendor attestations, and recurring test records (e.g., UPS and generator tests). WatchDog Security's Compliance Center can help organize evidence by control, flag missing items, and maintain an audit-ready trail for supporting-utility resilience.
Utility disruptions are often managed as ongoing risks with defined treatments (redundancy, testing, vendor assurance) and owners. WatchDog Security's Risk Register can help document utility-failure risks, score impact, assign remediation tasks, and report progress to stakeholders.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-17 | GRC Team | Initial publication |
