Control A.7.11Supporting utilities
Information processing facilities must be protected from power failures and other disruptions caused by failures in supporting utilities.
Power, and also cooling, water, ventilation and telecommunications — the services that information processing depends on and that are not usually owned by the organisation.
The control asks for protection proportionate to the dependency: uninterruptible supplies sized for the time actually needed, generators where the continuity objectives require them, redundant feeds where the risk justifies the cost, and monitoring that reports a utility problem before it becomes an outage.
The recurring failure is not the absence of the equipment but the absence of testing. A UPS whose batteries have degraded, a generator that has never run under load, or a failover that has never been exercised will be discovered at the only moment it matters. That testing is the same discipline A.5.30 requires for ICT readiness.
In shared premises and colocation, these arrangements belong to the provider and are a supplier assurance question under A.5.22.
How to put this in place
Power, cooling and communications failures stop services even without an attacker. The project must identify critical equipment on your own premises and give it what it needs, and rely on providers' assurance for hosted equipment.
- List the equipment on your premises that must keep working.
- Decide what it needs: backup power, cooling, a second connection.
- Install it and set maintenance on the supplier's schedule.
- Test failover, such as the UPS and the second link, and record the results.
- For hosted services, obtain the provider's assurance reports.
Evidence an auditor usually looks for: UPS and generator test records, maintenance contracts, and provider assurance reports for hosted equipment.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.