ISO 27001 A.7.11: Protect the utilities your information services need

What A.7.11 requires in practice

Annex A control 7.11 asks that information processing facilities are protected against power failures and other disruptions caused by failure of the utilities that support them. Utilities include electricity, cooling, water and telecommunications connections. The control expects the organisation to understand which services depend on which utilities, to decide what should happen when a utility fails, and to put in place suitable protection, maintenance and testing. Some services need to keep running; others need an orderly shutdown and restart. The outputs are a dependency view of important services, protective arrangements sized to real demand, a defined response to interruption, and evidence that they are maintained and tested. The standard does not demand generators or duplicate supplies in every office. What it looks for is proportion: arrangements that fit the service, the risk and the consequences of interruption.

Map the service rather than a single device

Choose an important business service and follow what it needs to operate. A server may have backup power while the network device, cooling system or provider connection does not. A remote application can remain available in its data centre while the local office loses the connectivity needed to use it. Identify these dependencies before selecting additional equipment.

Define the intended response to an interruption. Some services may need continued operation; others may require an orderly shutdown and controlled restart. The choice should reflect business and information-security requirements. A battery runtime quoted in a product brochure does not by itself establish that the organisation's complete service can continue for that period.

Check capacity, condition and interactions

Utility arrangements need to match actual and expected demand. Additional equipment or a changed occupancy pattern can invalidate an earlier assessment. Review capacity and maintenance with competent specialists, including the way one utility depends on another. Protection that is adequate under a light test may behave differently under normal operating load.

Define how faults are detected, who receives notification and what they can authorise. Where utilities are managed through networked equipment, consider the security of that management connection as well as the physical installation. This guide does not prescribe electrical work or engineering design; competent personnel and applicable technical requirements govern those activities.

Why protecting supporting utilities matters to the business

Customers experience a utility failure as an outage, not as a power fault. A service can be perfectly secure and still unusable because cooling failed or the connection was cut. Disorderly shutdowns can also corrupt data, turning a short interruption into a long recovery. Understanding dependencies before something fails lets the organisation spend on the weakest link rather than on equipment that is already well protected. Customers with availability commitments often ask how supporting utilities are handled. At audit, utility arrangements are tested by asking what happens when power or connectivity is lost, so a rehearsed answer supported by test records is far stronger than an assumption.

How to implement A.7.11

Follow the service, not just the server, to find the real dependencies. Where a provider supplies the facility, ask what it protects and how you will learn of any interruption. Involve the service owners, since facilities staff alone may not know which services matter most.

1. Choose an important business service and list everything it needs to run, including power, cooling and connectivity.
2. Identify weak links, such as protected servers with unprotected network equipment or a single provider connection.
3. Decide the intended response to interruption: continued operation for some services, orderly shutdown for others.
4. Size protective equipment against actual and expected demand, and review it when load or occupancy changes.
5. Agree who looks after utilities, covering facilities, IT, service owners and external providers.
6. Maintain and test the arrangements, and record the results and any follow-up action.
7. Include the restart procedure so that services return in the right order after an interruption.

Evidence an auditor expects for A.7.11

An auditor will want to see that utility dependencies were understood and that protection is maintained and checked. Typical evidence combines records with observation. Records are more convincing when they show real dates and named responsible roles rather than a generic statement.

• A dependency view for at least one important service, covering power, cooling and connectivity.
• Maintenance and test records for protective equipment such as battery or generator systems.
• Records of past interruptions and what was learned.
• Observation of equipment rooms, including condition and monitoring.
• Interview with the service owner about expected behaviour during a failure.

Common nonconformities with A.7.11

Typical findings show protection that is assumed rather than tested. They commonly reflect a good original design that was never revisited as equipment, demand and occupancy changed over time, which is why dated test records matter.

• Servers protected by battery backup while network or cooling equipment is not.
• Protective equipment never tested under realistic load.
• Capacity assessments that predate added equipment or increased staffing.
• No defined response or restart sequence after a utility failure.
• Dependence on a single provider connection for a service described as critical.

Illustrative BPO example: servers remain powered but agents cannot connect

Illustrative software example: two connections with one physical weakness

A hypothetical software company buys a second internet service to improve availability. The providers are different, but both connections enter through the same vulnerable building route. A local cable incident could therefore affect both, although purchasing records describe them as independent services.

The company confirms routing and building responsibilities with the providers and evaluates appropriate alternatives. Where complete separation is not available, it records the remaining dependency and adjusts its continuity arrangements. The evidence is the understood design and tested response, not the number of contracts. This example shows why diversity needs verification rather than assumption.

Agree what the building or service provider delivers

Leased premises can place utility equipment outside the organisation's direct control. Establish the service provided, maintenance responsibilities, change notification and access to relevant assurance. Determine how an outage is reported and what information the provider supplies while recovery is underway.

Operational owners need accessible contact and escalation arrangements, including outside ordinary office hours where relevant. A contract stored in a procurement repository may not help a team facing a service interruption. Keep essential response information usable during the very loss of power or connectivity it is intended to address.

Use safe, meaningful tests

Testing should answer a defined question within an authorised plan. It can include reviewing maintenance evidence, checking alarm delivery or exercising an agreed interruption scenario with competent technical support. Do not improvise utility cut-offs to prove a control works. Consider dependencies, safety, recovery and business impact before a test is approved.

Useful evidence includes the assessed requirement, design basis, maintenance status, capacity review and test findings. These are possible methods, not a universal ISO record set. The ISMS should demonstrate implementation and respond to shortcomings rather than repeatedly accepting failed tests without an accountable decision.

Connect utility protection with redundancy, ICT continuity readiness and equipment maintenance. Under operational planning, make their responsibilities meet at the service level.