ISO 27001 Control 7.11: Supporting Utilities
Information processing facilities depend on reliable electricity, water, and telecommunications to operate safely. Control 7.11 requires organizations to protect critical systems from disruptions caused by utility failures, ensuring business continuity and data integrity during infrastructure outages.
What this means
Supporting utilities—electricity, water supply, telecommunications, and HVAC systems—are essential infrastructure that your information processing facilities rely on. This control requires you to implement safeguards that prevent or mitigate the impact of utility failures on your IT systems. You must design resilience into your physical and logical infrastructure to handle temporary outages without compromising data security or availability.
How to comply
- 1.Conduct a risk assessment to identify critical utilities that support your information processing facilities
- 2.Install uninterruptible power supplies (UPS) and backup generators for essential systems
- 3.Implement redundant telecommunications connections and failover mechanisms
- 4.Establish water management systems or location controls to prevent water damage to equipment
- 5.Create and test emergency response procedures for utility outages
- 6.Monitor utility performance and establish SLAs with utility providers where possible
- 7.Document all supporting utility infrastructure and dependencies in your asset inventory
- 8.Schedule regular maintenance and testing of backup systems to ensure functionality
Evidence auditors look for
- UPS system specifications and testing logs
- Backup generator maintenance records and load testing results
- Redundant telecommunications contracts with multiple providers
- Power distribution diagrams and facility infrastructure documentation
- Emergency response procedures and outage recovery plans
- Utility failure incident logs and remediation actions
- Backup system capacity calculations and risk assessments
- Service level agreements with utility providers
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates documentation and monitoring of your supporting utilities infrastructure—tracking UPS tests, generator maintenance, and redundancy status—so you demonstrate continuous control effectiveness to auditors without manual spreadsheets.
See how GRCWatch handles this control automatically
Start free trial