Supporting utilities
Purpose
Protect information processing facilities from power failures and other disruptions in supporting utilities.
How to meet this control
In short: Protect facilities from failure of supporting utilities (power, cooling).
- Step 01Install a UPS sized to support an orderly shutdown or bridge to a generator for on-premises server and comms rooms
- Step 02Maintain power, cooling and other utility equipment to manufacturer specification and inspect and test it on a schedule
- Step 03Review utility capacity against business growth so power and cooling keep pace with added equipment
- Step 04Provide alarms that flag utility malfunctions, such as power-loss or over-temperature alerts, to the responsible team
- Step 05Provide diverse feeds or redundant routing where availability requirements justify it, and fit emergency lighting and cut-off switches near exits
- Step 06For cloud-hosted workloads, confirm the provider utility resilience commitments rather than running on-prem utilities
Tip: UPS and, for on-prem rooms, redundant power/cooling.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Configure, operate and maintain utility equipment in line with manufacturer specifications
- ›Regularly review utility capacity against business growth and interactions between utilities
- ›Inspect and test utility-supporting equipment regularly to confirm it works
- ›Raise alarms to detect utility malfunctions where needed
- ›Provide multiple feeds with diverse physical routing where necessary
- ›Keep utility-supporting equipment on a separate network, connected to the internet only when needed
- ›Provide emergency lighting and communications and place emergency cut-off switches near exits
Audit evidence to keep
- - UPS and generator installation and test records
- - Maintenance schedule and logs for utility equipment
- - Utility capacity review documentation
- - Alarm configuration for power and environmental faults
- - Evidence of emergency lighting and cut-off switch placement
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.7.11. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.