Supporting utilities

What the requirement asks

Information processing facilities are to be protected against power cuts and other disruption caused by failures of supporting utilities. Purpose: keep information and assets from being lost, harmed or compromised, and keep operations running, when utilities fail or are disrupted. Guidance: facilities rely on utilities such as electricity, telecommunications, water, gas, sewerage, ventilation and air conditioning, so the organization should make sure utility equipment is set up, run and maintained to manufacturers' specifications; review utilities regularly for capacity to support business growth and for how they interact with each other; inspect and test utility equipment regularly so it works properly; raise alarms to detect utility faults where needed; provide multiple feeds over physically diverse routes where needed; put networked utility equipment on a network separate from the processing facilities; and expose it to the internet only for a real need and then through a secure connection. Provide emergency lighting and communications, place emergency cut-offs for power, water, gas and other utilities near emergency exits or equipment rooms, and record emergency contact details where staff can reach them during an outage. Other information: using several routes from more than one provider adds network redundancy. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Supporting utilities are a dependency. The guidance asks for the utility, the capacity, the backup, the alarm and the test.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep maintenance and test records for UPS, generators, HVAC and other utility equipment against manufacturer specifications and one live sample together.

Evidence an assessor asks for

• Utility resilienceMaintenance and test records for UPS, generators, HVAC and other utility equipment against manufacturer specifications
• Utility resilienceCapacity reviews of power, cooling and connectivity against business growth
• Utility resilienceAlarm and monitoring configuration for utility failures
• Utility resilienceDiagrams showing diverse feeds and routes for power and telecommunications where required
• Utility resilienceNetwork architecture showing building management and utility systems segregated from IT networks, with controlled internet exposure
• Utility resilienceEmergency lighting, emergency cut-off locations and an accessible emergency contact list

The question an assessor will ask

An assessor will ask for maintenance and test records for UPS, generators, HVAC and other utility equipment against manufacturer specifications, then trace it to the system it protects. For A.7.11 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Generators and UPS are not load-tested regularly
• Building management systems sit on the corporate network or are reachable from the internet
• A single power or telecom feed is a single point of failure
• Cooling capacity was not reviewed after adding equipment

Before the next audit

Before the next audit, check one live sample for this gap: generators and ups are not load-tested regularly.