ISO/IEC 27001:2022 Annex A · Control 7.11

Supporting Utilities: A Practical Implementation Guide

Protect critical information processing from failures in power, cooling, water, communications and other utilities.

This control concerns protecting information-processing facilities from power failures and disruptions caused by supporting utilities.

Practical interpretation: Utility resilience requires known dependencies, capacity, maintenance, monitoring and tested failover—not merely possession of a UPS.

What should the control achieve?

Critical utility dependencies are identified.
Capacity and resilience match service requirements.
Failures and environmental conditions are monitored.
Backup supplies and shutdown procedures are tested.

Step-by-step implementation

Map utilities and dependencies

Include power, cooling, water, fuel, communications and building management.

Set resilience needs

Use service criticality and recovery objectives to determine redundancy and runtime.

Design protection

Use UPS, generators, dual feeds, redundant cooling, surge protection and safe shutoff.

Monitor capacity and condition

Alert on load, battery health, temperature, fuel and utility loss.

Maintain safely

Follow manufacturer schedules and control contractor access.

Test under load

Exercise failover, runtime, shutdown and recovery with realistic demand.

What this could look like in practice

A server room has UPS coverage for safe shutdown and a generator for extended outages. Monthly self-tests and annual load-bank tests are reviewed. Cooling alarms reach on-call Facilities and IT.

Activity	Practical implementation	Evidence
Power loss	UPS bridges outage and generator starts automatically.	Test log
Cooling failure	Temperature threshold alerts responders.	Environmental event
Maintenance	Qualified contractor follows controlled work plan.	Maintenance record
Extended outage	Runbook prioritizes shutdown and continuity.	Exercise report

Implementation evidence

Utility dependency map
Capacity calculations
UPS and generator inventory
Monitoring configuration
Maintenance records
Load tests
Fuel checks
Shutdown procedures

Useful metrics

Utility tests passed
Capacity threshold exceeded
Maintenance overdue
Utility incidents affecting service

Common mistakes

Testing generator start without load.
Ignoring fuel availability and contracts.
Putting redundant equipment on one circuit.
No alert response outside hours.
Failing to coordinate building maintenance.

Questions an auditor may ask

Which utilities support critical services?
How was runtime determined?
Show tests under realistic load.
What happens if cooling fails?

Implementation test: Simulate utility loss and verify detection, failover, runtime, communication, safe shutdown and restoration.

Continue through Annex A

Explore the growing library of practical guides for all 93 Annex A controls.

Open the ISO 27001 Annex A Control Library

This independent educational guide paraphrases the practical intent of the control and does not replace the official ISO standards, professional advice or an organization-specific risk assessment. It is not affiliated with or endorsed by ISO.

ISO 27001 Annex A 7.11: Supporting Utilities – Practical Implementation Guide