ISO 27001 Control A.7.11: Supporting Utilities

Every system you run sits on top of things nobody puts in an architecture diagram: electricity, cooling, water, gas, telecoms links. When they work, they are invisible. When they fail, your best-engineered application goes dark and the cause is a tripped breaker or a digger through a cable. A.7.11 is the eleventh of 14 physical controls in our walk through Annex A, and it is about the quiet dependencies underneath the technology.

For organizations that run everything in the cloud, this can feel like someone else’s problem. Partly it is, and that is worth writing down. But your office network, your phones, your door access system and the laptop of every employee on a bad-weather day all rely on utilities too. The honest approach is to know which dependencies are yours and which belong to a provider you rely on.

What the control requires

Annex A control 7.11 of ISO 27001:2022 states that information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.

The key elements:

Information processing facilities - server rooms, comms rooms, offices that hold critical equipment, and any location where information is processed
Power failures - the most common utility problem, from brief dips to long outages
Other disruptions caused by failures in supporting utilities - cooling, ventilation, water, gas and telecommunications, as well as the infrastructure that delivers them

A.7.11 is classified in ISO/IEC 27002:2022 as a preventive control, with a detective element in monitoring utility failures. Annex A states the control; ISO 27002 gives guidance, including that supporting utilities should be configured in accordance with equipment manufacturers’ specifications, evaluated regularly for capacity, inspected and tested to ensure proper functioning, and equipped with alarms to detect malfunctions where necessary. Redundant routes and emergency lighting and switches are also mentioned. Where you rely on a provider for the facility, the responsibility moves into your supplier arrangements rather than disappearing.

How to implement supporting utilities protection

Map the dependencies and the impact

Start with a simple table: for each critical system or location, list what it depends on and what happens if that dependency stops. Electricity is the obvious one. Cooling comes next, because a server room can overheat in minutes once the air conditioning stops. Internet connectivity, voice lines, and sometimes water for fire suppression or cooling towers follow. Use your business impact thinking to set the tolerance: a ten-minute outage may be fine for a file server and unacceptable for a payment system. This ties directly into the thinking behind protecting against physical and environmental threats, where power loss, flooding and fire sit side by side.

For each dependency, record the owner. Some are yours, some belong to the landlord, and some to a data centre or cloud provider. Anything that belongs to someone else belongs in a supplier conversation, with evidence you can ask for.

Build resilience in proportion to need

Not every organization needs a generator. What you need is a considered answer. Typical measures, from light to heavy, include:

Surge protection and an uninterruptible power supply (UPS) for servers, network gear and other critical equipment, sized to ride out short outages and shut down cleanly
Backup generation for sites that must keep running through long outages, with fuel supply arrangements
Redundant power feeds and separate circuits for critical equipment
Cooling with capacity to spare, and a plan for what happens if it fails
Two internet connections from different providers or routes, with automatic failover
Emergency power-off switches placed carefully and protected against accidental use
Emergency lighting in equipment rooms and along escape routes

A small office might be fully served by a UPS on the network cabinet and a mobile-data backup link. A larger site will do more. What matters is that the choice follows the impact and is written down.

Test it and monitor it

Resilience that has never been tried is a hope. Test UPS batteries on a schedule, and replace them before they fail, since battery capacity declines with age. Run a generator under load according to the maker’s recommendations. Pull the primary internet link on a quiet afternoon and confirm that failover works. Keep the records, because they are the evidence an auditor wants to see.

Add alarms where they pay off: temperature and humidity sensors in server rooms, power status from the UPS, and alerts for connectivity loss, delivered to a person who can act. The same discipline as in physical security monitoring applies: an alert that nobody receives is not monitoring. Maintenance matters too; it is covered in more depth in our post on the later control on equipment maintenance (A.7.13).

Connect it to continuity and suppliers

Utility failure is a classic trigger for continuity plans. Record the expected outage tolerance, what manual workarounds exist, and when the plan switches to alternate sites or remote working. For services provided by others, check the commitments: ask the data centre about power and cooling redundancy, read the availability terms in cloud contracts, and note who is responsible for what. Ask for the evidence your auditor will ask you for: independent reports, test results or contractual commitments. Later controls on supplier relationships and on ICT readiness for business continuity go deeper, but the habit begins here with knowing what you depend on. Finally, review the picture after every significant change, such as new equipment that draws more power or a move to a new building.

A.7.1 connection. Physical security perimeters identify the areas where critical utilities and equipment are located and need protection.

A.7.5 connection. Protecting against physical and environmental threats addresses fire, flood and other events that can take out utilities.

A.7.8 connection. Equipment siting and protection places equipment away from risks such as water pipes and heat, which complements utility protection.

A.7.9 connection. Security of assets off-premises reminds us that equipment used away from your sites depends on utilities you do not control.

Clause 8.1 connection. Operational planning and control expects the processes needed to meet your requirements to be planned and controlled, and utility resilience is part of that planning.

Clause 6.1 connection. Actions to address risks and opportunities is where utility failure risks are identified and treated.

Forward reference. Cabling security (A.7.12) and Equipment maintenance (A.7.13) follow in the series, and later organizational controls on ICT readiness for business continuity (A.5.30) and information security during disruption (A.5.29) build on the dependencies you map here.

What auditors check

Dependency awareness. Auditors ask which utilities your critical systems rely on and whether you have thought about what happens when they fail.

Protective measures. They look for UPS, generator, cooling and connectivity arrangements that match the criticality you have claimed.

Testing and maintenance records. Battery test logs, generator runs, failover tests and service reports are typical evidence.

Monitoring and alarms. Expect questions about who is alerted to overheating or power loss, and how quickly someone responds.

Provider assurance. For hosted or leased facilities, auditors look for contracts, certifications or reports that show the provider’s utilities are resilient.

Link to risk and continuity. They check that utility failure appears in your risk assessment and that continuity plans reflect real tolerances.

Common mistakes to avoid

A UPS nobody has tested. Batteries wear out. An old unit that has never been checked may last seconds, not minutes.

Ignoring cooling. Power gets the attention; temperature does the damage. A UPS keeps the servers running while the room heats up.

One internet link for everything. A single provider is a single point of failure. A cheap backup link often pays for itself the first time it is needed.

Assuming the cloud is immune. Your offices, networks and staff still depend on utilities, and cloud providers vary in their redundancy.

No owner for landlord-managed utilities. In a shared building, power and cooling may be managed by someone else. Agree who tells whom when something changes.

Emergency switches without protection. A power-off switch that is easy to hit by accident has caused its own outages.

Tests only on paper. Plans that were never exercised tend to fail at the moment they are needed.

How 27kay can help

We help organizations understand what their systems really depend on and choose resilience that fits, without buying a generator for a ten-person office. As part of ISO 27001 implementation, we map your dependencies, tie them to your risk assessment and continuity thinking, and prepare the evidence auditors expect. For the full picture, see our ISO 27001 knowledge hub.

If the power went out at your main site at 10am on a Monday, would you know how long you could carry on? Get in touch - we will help you find the answer before the lights do.