ISO 27019 controls and requirements, for energy systems that have to stay secure and running.

What it is

What is ISO 27019 and what is it used for?

ISO/IEC 27019 is the energy sector's version of the international security control catalogue. Its title is "Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry", and it is published jointly by ISO and IEC. It applies the ISO/IEC 27002:2022 guidance to the technology that keeps energy flowing: process control and automation, controllers and field devices such as PLCs, smart meters, protection and safety systems, energy management for distributed resources and charging, and smart grid components.

It closes a gap that office-focused programmes leave open: a utility's most serious risks sit in substations, pipelines and control centres, not only in servers and laptops, and ISO/IEC 27019 gives the ISMS team and the engineers one set of controls. It does not cover the process control domain of nuclear facilities, which IEC 63096 addresses.

Current edition. ISO/IEC 27019:2024, the second edition, reached publication in October 2024 and withdrew ISO/IEC 27019:2017. The new edition follows the organisational, people, physical and technological themes of ISO/IEC 27002:2022, removes guidance that repeated the parent catalogue and adds attributes to the energy-specific controls. ISO shows no further revision under way. ISO/IEC 27001 Annex A controls explained

Who it is for

Who needs ISO 27019?

The standard speaks to everyone who runs or supplies energy systems: generation and network operators, gas, oil and district heating companies, metering providers, and the engineering and managed-service firms that maintain control systems for them. They reach Sterling from four starting points:

• A regulator expects it. In Germany, the Bundesnetzagentur's IT security catalogues build on ISO/IEC 27001 and ISO/IEC 27019, and its catalogue for grid operators requires the ISMS to be certified by an independent, accredited body. Elsewhere, check what your energy regulator expects, with your legal advisers.
• A tender for utility work names it. Bids for control system, metering or grid projects often ask how the supplier protects the operator's systems, and an ISO/IEC 27001 certificate with energy controls in scope answers that directly.
• A utility customer audits you as a supplier. Remote access to their plant and patching of their devices come under scrutiny; the energy controls show how each is managed.
• The group wants one baseline across its assets. A group with plants and networks in several countries assesses every subsidiary against the same controls.

Requirements

What are the ISO 27019 controls and requirements?

ISO/IEC 27019 contains guidance rather than auditable requirements; the obligation to choose controls from a risk assessment comes from ISO/IEC 27001. Its controls fall into three kinds: controls taken unchanged from ISO/IEC 27002, controls that carry additional guidance for the energy sector, and new controls for the sector, identified by the prefix ENR. The list below follows the document's structure at title level; your controls are compared with the standard itself during the gap assessment.

• Clauses 1 to 4 Scope, references, terms and structure: the energy systems covered, the nuclear exclusion, the vocabulary used and how the controls are presented.
• Clause 5 Organisational controls: the governance, supplier, incident and continuity controls of the parent catalogue, with energy guidance and ENR controls where operators need more.
• Clause 6 People controls: screening, awareness and responsibilities for staff and contractors, including those who work on operational sites.
• Clause 7 Physical controls: protection of premises and equipment, which for a utility extends to control centres, substations and unmanned field locations.
• Clause 8 Technological controls: access, configuration, monitoring and network protection, applied to controllers, field devices, metering and the links between them.
• Annex A Energy utility industry specific controls reference: an index of the controls added for the sector.
• Annex B Correspondence with the first edition: the map from the 2017 controls to the 2024 ones, used when an existing Statement of Applicability is updated.

Putting it into practice

How do you implement ISO 27019 controls?

As guidance, ISO/IEC 27019 leads to controls working in your plants and networks and to the records that prove it. Where a regulator or customer wants independent assurance, those controls run inside an ISO/IEC 27001 ISMS and the certification body audits that system.

1. 01
   Define the scope across IT and operations.Agree the sites, networks, control systems, metering and suppliers the ISMS will cover, and who owns each of them.
2. 02
   Assess the risks, then the gaps.Assess risks to process control and supporting IT together; our gap assessment then compares today's practice with the ISO/IEC 27019 and ISO/IEC 27002 guidance.
3. 03
   Select and implement the controls.Record the chosen controls, including the ENR controls, with reasons in the Statement of Applicability, then put them into use with engineering and IT owners, planned around outage windows.
4. 04
   Audit and review internally.Internal audit samples controls at operational sites as well as in the office; management review decides on findings, incidents and risk treatment, and actions are closed with evidence.
5. 05
   Obtain ISO/IEC 27001 certification where it is needed.An accredited certification body runs its Stage 1 readiness review and Stage 2 audit of the ISMS, decides on certification and returns for surveillance audits each year of the three-year cycle.

Check the route before you sign. A document claiming certification "to ISO 27019" is not an accredited certificate; the certificate is issued against ISO/IEC 27001, by a body working to ISO/IEC 17021-1 and ISO/IEC 27006-1. Ask how the energy controls will appear in the scope, confirm the body's accreditation for information security with an accreditation body recognised under the Global ACI arrangement, and check any conditions your regulator sets. The certification buyer's checklist

Cost

How much does ISO 27019 implementation cost?

The budget is set less by headcount than by the energy estate: how many plants, substations, networks and device types fall in scope, and how much of that estate is already governed. Certification to ISO/IEC 27001, where it is planned, is a separate fee from the certification body.

Timeline

How long does ISO 27019 implementation take?

Operational technology sets its own pace: changes wait for maintenance windows and some devices need the vendor. An ISMS that already covers IT shortens the work. As an estimate, bringing the energy controls into a working ISMS typically takes five to nine months, with ISO/IEC 27001 certification adding the certification body's scheduling.

Your engagement

What your ISO 27019 engagement includes

Every engagement runs on Sterling OS™, adapted to the mix of IT and operational technology in an energy business. Sterling does not certify: where a certificate is needed, the accredited certification body audits your ISO/IEC 27001 system and makes the decision.

• Design™: guided support

  Your team drafts the risk assessment, Statement of Applicability and procedures; a Sterling consultant sets the method, explains the energy guidance and reviews every draft.

• Drive™: managed support

  The alternative to Design™ when engineers have no time to spare: Sterling prepares the controls and records with your owners and takes the programme through internal audit and review.

• Sustain™: after go-live or certification

  Internal audits across sites, periodic control checks, risk reviews and preparation for customer audits, regulator requests and ISO/IEC 27001 surveillance.

• Automate™: Effivity

  Assets, risks, the Statement of Applicability, incidents, audits and corrective actions run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 27019

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• API Spec Q1API Spec Q1 certification consulting for oil and gas suppliers: contract review, design, purchasing and release controlled, prepared for the APIQR audit.
• AWS StandardAWS water stewardship certification to the Alliance for Water Stewardship Standard: what it is, who asks for it and how Sterling prepares your site for audit.
• CHAS, SafeContractor and AchillesCHAS, SafeContractor and Achilles accreditation for UK contractors: what each scheme is, who asks for it and how Sterling prepares your evidence.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.