ASD ISM 1123 Ensure UPS powers all TOP SECRET IT equipment
What it says
A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET IT equipment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll Top Secret IT equipment must use power from a board with a UPS to maintain functionality during power outages.
All Top Secret IT equipment needs to be connected to an Uninterruptible Power Supply (UPS) to ensure it keeps running during a power outage. This is crucial because if such equipment loses power unexpectedly, sensitive data could be at risk, operations could be disrupted, and you might face significant downtime and security breaches.
Free. Save your status, tasks and notes.
Why it matters
Without UPS-backed power distribution, TOP SECRET systems may shut down in outages, causing data loss and mission disruption.
How to implement
The IT team should install a UPS system for all Top Secret IT equipment.
This can be done by first assessing the power requirements of each device and then choosing a UPS that can handle that load and has enough battery life to cover typical outages.
Facilities management should ensure that the power distribution board in use is correctly connected to the UPS.
They can do this by working with an electrician to install the necessary cabling and confirm that power is fed through the UPS.
Managers should create a maintenance schedule for the UPS systems.
This involves regular testing and battery checks, which help ensure the UPS can provide backup power when needed.
System owners should document which equipment is powered by the UPS and update this inventory whenever there are changes in the setup.
This helps keep track of which devices are protected and ensures all necessary equipment is covered.
IT security personnel should verify and periodically review the setup to confirm that all Top Secret IT equipment remains connected through the UPS.
This can be done by cross-referencing the equipment inventory against the power configuration.
Keep it running
Test the UPS and its feed to the power distribution board; replace batteries on schedule and confirm TOP SECRET racks stay on UPS power.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The UPS installation plan: Request documentation or diagrams that show how the UPS is connected to the Top Secret IT equipment.
Look at
The connections and ensure they indicate a direct feed from the UPS to each piece of equipment.
Good evidence
Will show clear and complete links for all equipment listed.
- Check 2 of 5What an auditor asks for
Ask for
The maintenance log: Examine the record of maintenance activities for the UPS.
Look at
Regular entries that show consistent and routine checks have been performed.
Good evidence
Log has entries with dates, activities performed, and signatures of those who conducted the maintenance.
- Check 3 of 5What an auditor asks for
Ask for
To see the equipment inventory: Check the list of Top Secret IT equipment against the UPS setup. Look to see that all listed items are aligned with the UPS connections.
Good evidence
Will have a comprehensive and updated list that matches with the UPS-fed power board.
- Check 4 of 5What an auditor asks for
Ask for
Testing procedures: Request the documentation that outlines how the system's UPS is tested for effectiveness during outages.
Look at
The frequency and the outcomes of these tests.
Good evidence
Procedure shows successful test results and includes plans for correcting any issues found.
- Check 5 of 5What an auditor asks for
Ask for
Incident response documentation: See if there is a plan for what happens when the UPS fails.
Look at
Detailed steps and responsible parties to manage the continuity of equipment operation.
Good evidence
Provides clear action plans and roles during power incidents.
Mappings
Closest match in ISO/IEC 27001: A.7.11, Protection from utility failures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.11.
ISM-1123 requires a power distribution board fed by an Uninterruptible Power Supply (UPS) to power all TOP SECRET IT equipment to maintain operation during power outages. This relates directly to Annex A 7.11, which requires protection of information processing facilities from utility failures, including power failures. ISM-1123 is a prescriptive, classification-specific implementation detail (UPS-fed distribution for TOP SECRET), whereas Annex A 7.11 is broader and technology-agnostic.
This control depends on A.5.30.
ISM-1123 requires UPS power to be used for all TOP SECRET IT equipment so services remain available during loss of mains power. This supports Annex A 5.30 because UPS-backed power is a common ICT continuity measure that contributes to ICT readiness for business continuity objectives. Annex A 5.30 includes planning, testing and broader continuity arrangements, whereas ISM-1123 is a single physical power-control requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.