Supporting utilities

Plain-language summary

Protecting information processing facilities against failures and disruptions in the utilities they depend on — electricity, telecommunications, water, cooling and ventilation — through backup supply, monitoring and testing sized to how long you must keep running.

What the clause is really asking

Equipment is useless without power, cooling and connectivity, and this control asks you to make sure a failure in those utilities does not take your information processing down with it. That means knowing which utilities each critical facility relies on, checking they meet specifications and have capacity for growth, testing them regularly, alarming on failure, and providing alternative feeds or backup where justified. In South Africa this is a live availability threat: load-shedding, municipal supply failures, cable theft and voltage spikes when power is restored. The design questions are concrete: how long does the UPS hold the servers, does the generator start automatically and how much fuel is on site, are firewalls, fibre terminals, routers and access control on backup too, and what happens when the provider's exchange or cell tower runs out of battery. The misunderstanding is that a UPS is enough; batteries age, untested generators fail to start, and cooling often goes down while the servers stay up. Your plant maintenance system already tracks the generator; add the IT dependencies.

What auditors look for

Auditors ask for the list of utilities supporting critical facilities and the backup for each. They check UPS runtime against the outage you plan for, battery age and test records, and generator start tests under load, fuel level and refuelling arrangements. They ask whether cooling, network equipment and the alarm system are on backup power. They look for alerts on power state, UPS status and temperature. They ask about the second internet link and whether it takes a different route. The hard question: when did you last switch off the mains and run on backup, and what failed?

Typical evidence

Utility dependency list for critical facilities; UPS specifications, runtime calculations and battery test or replacement records; generator service and load test records; fuel management and refuelling arrangements; power and environmental monitoring alerts; redundant internet or telecom links with diverse routing; cooling maintenance records; outage records showing how systems performed.

How to comply — recommendations

List what each critical facility needs: power, cooling, network and, where relevant, water. Work out the runtime you need from your longest likely outage and size UPS, inverter and generator capacity to match, including firewalls, switches, fibre terminals, access control and CCTV. Test the generator monthly under load and run a full mains-off test at least twice a year. Replace UPS batteries on a schedule. Add a second internet link from a different provider or medium. Set alerts for power state and server room temperature. Put this equipment into the plant maintenance system so it gets the same discipline as production assets.

Common nonconformities

UPS batteries expired or never tested; generator not load-tested, or no fuel plan; network, cooling or alarm systems not on backup power; single internet link with no alternative; no monitoring or alerting on power and cooling; backup runtime not matched to expected outage length; outages cause unplanned shutdowns and data corruption.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.