## 7.11 Supporting utilities

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|-----------------------|------------------------------------|---------------------------|-----------------------------|----------------------|

| #Preventive<br>#Detective | #Integrity<br>#Availability | #Protect #Detect | #Physical_security | #Protection |

  

**Control**

  

Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.

  

**Purpose**

  

To prevent loss, damage or compromise of information and other associated assets, or interruption to the organization’s operations due to failure and disruption of supporting utilities.

  

**Guidance**

  

Organizations depend on utilities (e.g. electricity, telecommunications, water supply, gas, sewage, ventilation and air conditioning) to support their information processing facilities. Therefore, the organization should:

  

a\) ensure equipment supporting the utilities is configured, operated and maintained in accordance with the relevant manufacturer’s specifications;

  

b\) ensure utilities are appraised regularly for their capacity to meet business growth and interactions with other supporting utilities;

  

c\) ensure equipment supporting the utilities is inspected and tested regularly to ensure their proper functioning;

  

d\) if necessary, raise alarms to detect utilities malfunctions;

  

e\) if necessary, ensure utilities have multiple feeds with diverse physical routing;

  

f\) ensure equipment supporting the utilities is on a separate network from the information processing facilities if connected to a network;

  

g\) ensure equipment supporting the utilities is connected to the internet only when needed and only in a secure manner.

  

Emergency lighting and communications should be provided. Emergency switches and valves to cut off power, water, gas or other utilities should be located near emergency exits or equipment rooms. Emergency contact details should be recorded and available to personnel in the event of an outage.

  

**Other information**

  

Additional redundancy for network connectivity can be obtained by means of multiple routes from more than one utility provider.