---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.7.11"
title: "Supporting utilities"
theme: Physical
control_type:
  - Preventive
  - Detective
information_security_properties:
  - Integrity
  - Availability
cybersecurity_concepts:
  - Protect
  - Detect
operational_capabilities: [Physical_security]
security_domains: [Protection]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 7.11 Supporting utilities

  

### Control

  

Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.

  

### Purpose

  

To prevent loss, damage or compromise of information and other associated assets, or interruption to the organization’s operations due to failure and disruption of supporting utilities.

  

### Guidance

  

Organizations depend on utilities (e.g. electricity, telecommunications, water supply, gas, sewage, ventilation and air conditioning) to support their information processing facilities. Therefore, the organization should:

  

a\) ensure equipment supporting the utilities is configured, operated and maintained in accordance with the relevant manufacturer’s specifications;

  

b\) ensure utilities are appraised regularly for their capacity to meet business growth and interactions with other supporting utilities;

  

c\) ensure equipment supporting the utilities is inspected and tested regularly to ensure their proper functioning;

  

d\) if necessary, raise alarms to detect utilities malfunctions;

  

e\) if necessary, ensure utilities have multiple feeds with diverse physical routing;

  

f\) ensure equipment supporting the utilities is on a separate network from the information processing facilities if connected to a network;

  

g\) ensure equipment supporting the utilities is connected to the internet only when needed and only in a secure manner.

  

Emergency lighting and communications should be provided. Emergency switches and valves to cut off power, water, gas or other utilities should be located near emergency exits or equipment rooms. Emergency contact details should be recorded and available to personnel in the event of an outage.

  

### Other information

  

Additional redundancy for network connectivity can be obtained by means of multiple routes from more than one utility provider.