ISO 27001 Annex A 7.11 Protection from utility failures
What it says
Information processing facilities shall be protected from power failures and other disruptions caused by failures in supporting utilities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure key equipment is safe from power and utility failures to avoid data loss.
This control is about protecting your critical equipment from utility failures, like power outages or water supply issues. These failures can disrupt your operations and lead to data loss, which is why it's important to have measures in place to prevent them.
Free. Save your status, tasks and notes.
Why it matters
Failure to protect against power and other utility disruptions can halt operations, cause data loss or corruption, and damage servers and network equipment.
How to implement
The IT manager should ensure that backup power systems, like generators or uninterruptible power supplies (UPS), are installed and operational.
This can be done by contacting a reliable vendor to purchase and set up the necessary backup systems according to the manufacturer's guidelines, ensuring continuity during power outages.
Facilities management should inspect and maintain utilities equipment regularly.
Schedule routine checks and maintenance following the manufacturer's recommendations to ensure equipment is functioning correctly and can handle unexpected utility disruptions.
The procurement team should evaluate utility providers to ensure they can meet current and future business needs.
This may involve reviewing service agreements and discussing redundancy options, like having multiple utility providers for better reliability.
Security personnel should ensure emergency procedures are in place, including emergency lighting and accessible shut-off switches for utilities near exits.
Train staff on these procedures to ensure quick and effective response in case of emergencies.
Senior management should ensure that any utility systems connected to your network are secured and only online when necessary.
Implement secure access controls, like secure passwords or firewalls, to protect against unauthorised access, as advised by ISO 27002:2022 and relevant Australian regulations like the Privacy Act 1988.
Keep it running
Regularly test UPS/generator systems and verify automatic failover for critical equipment so services switch safely during power or other utility outages.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request maintenance logs for backup power systems and other critical utilities equipment.
Look at
Check the frequency and thoroughness of inspections and maintenance activities recorded in the logs.
Good evidence
Up-to-date logs with regularly scheduled maintenance entries following manufacturer recommendations.
- Check 2 of 5What an auditor asks for
Ask for
Ask for emergency procedures documentation, including training records.
Look at
Verify that the procedures include emergency lighting, shut-off switches, and are located near emergency exits.
Good evidence
Comprehensive emergency procedures documented, with evidence of recent staff training sessions.
- Check 3 of 5What an auditor asks for
Ask for
Request documents or plans showing utility provider evaluations and redundancy measures.
Look at
Review the evaluation criteria and redundancy strategies for comprehensiveness and practicality.
Good evidence
Documented evaluations that consider multiple provider options and redundancy, with decisions based on thorough comparisons.
- Check 4 of 5What an auditor asks for
Ask for
Request network security configurations related to utility systems.
Look at
Examine how secure network connections are maintained, such as firewalls and restricted access.
Good evidence
Network configurations that demonstrate careful restriction of access and robust protection against external threats.
- Check 5 of 5What an auditor asks for
Ask for
Ask for records of utility capacity reviews and upgrades to support business growth.
Look at
Check that capacity assessments are periodically conducted and documented.
Good evidence
Records showing regular assessments and adjustments to utility capacity, aligning with business growth forecasts.
Mappings
Closest match in ASD Information Security Manual: ISM-1123, Ensure UPS powers all TOP SECRET IT equipment, which this control covers in full and more.
ASD Information Security Manual: 2 mappings
This control is broader than ISM-1123.
Annex A 7.11 requires information processing facilities to be protected from power failures and other supporting utility disruptions. ISM-1123 supports this by mandating UPS-backed power distribution for TOP SECRET IT equipment, which is a concrete measure to maintain power continuity during utility failures. ISM-1123 is narrower in scope (classification- and equipment-specific) while Annex A 7.11 also covers other utilities beyond electricity (e.g. HVAC, water, comms).
This control partially overlaps ISM-1580.
ISM-1580 requires online services with high availability needs to automatically transition between availability zones to maintain service availability. Annex A 7.11 focuses on protecting information processing facilities from utility failures (e.g. power disruption), typically via redundant power and environmental support, which contributes to availability. They overlap on the availability objective, but ISM-1580 is about application/service zone failover architecture, while Annex A 7.11 is about facility/utility resilience rather than multi-zone service design.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.