ISO 27001 A.7.11: Supporting utilities

Map out every supporting utility your information processing facilities depend on: electrical power, cooling and air conditioning, telecommunications links, water supply (for cooling and fire suppression), and gas supply (for gas-based fire suppression). For each one, assess the risk of failure and the impact on operations. For power, implement layered protection. Install UPS systems sized to run critical equipment for at least 15-30 minutes - long enough for generators to kick in or for an orderly shutdown. Deploy backup generators with automatic transfer switches that activate within seconds. Use power distribution units with surge protection and monitoring. For critical data centres, get dual power feeds from separate utility sources. Test UPS and generators under load regularly, not just on paper. For cooling: install redundant cooling units (N+1 minimum, 2N for critical data centres), monitor temperature and humidity with automated alerts, use hot aisle/cold aisle containment for efficient cooling, define clear escalation procedures for cooling failures, and stick to a preventive maintenance schedule. For telecommunications: get redundant network connections from different carriers, route cables through physically diverse paths, maintain a backup link (cellular or satellite) for critical connections, test failover regularly, and monitor link status with automated alerting. Set up maintenance schedules for everything. UPS batteries degrade over time and need regular testing and replacement. Generators need servicing. Cooling systems need maintenance. Fire suppression needs inspection. Keep service contracts with qualified providers for critical utilities. Write emergency procedures for each type of utility failure. Cover who to call, what immediate actions to take (like orderly system shutdown for extended power loss), escalation for different failure durations, and how to communicate with affected stakeholders.