Operational resilience
Controls that protect availability of generation and supply.
Implementation & guidance
ISO/IEC 27019 Energy Utility Security Controls
Current edition: ISO/IEC 27019:2024 · extension to ISO/IEC 27001
Information security controls for the energy utility industry, covering the process control systems that generate, transmit, store and distribute electric power, gas, oil and heat. It extends ISO/IEC 27002 into the operational technology environment.
2024Second edition
ISO/IEC 27019:2024 replaces the 2017 edition
The second edition, published in October 2024, aligns the energy sector controls with ISO/IEC 27002:2022. Utilities using the 2017 edition should review their control mapping and Statement of Applicability.
What the guidance covers
Security for energy process control
ISO/IEC 27019 applies to the process control domain and its supporting systems, where availability and safety come first.
Process control systems
Central and distributed control, monitoring and automation technology.
Field devices
Controllers, PLCs, sensors and actuators in the field.
Supporting systems
Historians, visualisation, reporting and documentation systems in the control domain.
Communication
Networks and communication technology used in process control.
Smart metering
Metering systems and their data flows.
Protection systems
Protection relays, safety PLCs and emergency mechanisms.
Distributed energy
Energy management for distributed resources and charging infrastructure.
Security zones
Segregation and protection of critical operational areas.
Why organisations implement it
What OT security assurance delivers
Regulatory readiness
A recognised basis for critical infrastructure security obligations.
IT and OT aligned
One ISMS covering office and operational environments.
Safer change
Security considered when control systems are modified or connected.
Supplier control
Security requirements for OT vendors and integrators.
One audit programme
Assessed alongside your ISO/IEC 27001 certification.
How we work
Path to assessed OT controls
One AEC methodology from first assessment to assessment, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 27019, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Control extension
We add the controls to your existing ISMS and Statement of Applicability.
Typically 2 to 4 monthsCombined build
We build ISO/IEC 27001 and the additional controls together.
Typically 6 to 9 monthsReadiness review
We test your controls against customer or regulator expectations before an audit.
Typically 1 to 2 months
How it is recognised
Assessed as an extension of ISO/IEC 27001
ISO/IEC 27019 is a code of practice, not a standalone certifiable management system standard. Its controls are implemented within an ISO/IEC 27001 management system, and many accredited certification bodies assess them alongside the ISO/IEC 27001 audit, referencing ISO/IEC 27019 on the certificate or in a separate statement. AEC prepares you for that assessment; the decision is the certification body's.
Built on your ISMS
Controls added to your ISO/IEC 27001 risk treatment and Statement of Applicability.
Assessment-ready
Evidence organised so the certification body can assess the additional controls in the same audit.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Case study
Energy sector in practice
Energy & utilities · Balochistan
Uch Power
ISO 9001, 14001 & 45001 · 2019 · 990 MW
1stAttempt
0Major NCs
2Plants
The challenge
Integrating two combined-cycle plants into one management system at a remote, safety-critical site, without disrupting round-the-clock generation.
What AEC did
Integrated documentation, legal register, risk assessments, training, internal audit and mock certification audit across both plants. Shows how we work inside live generation environments.
Certified at first attempt, no major nonconformities. One system covers generation, operation and maintenance across both plants.
Where it applies
ISO/IEC 27019 by industry
Power & utilities · generation, transmission and distribution
Oil & gas · pipelines, storage and processing
Government · public energy operators
Related standards
Questions
ISO/IEC 27019 FAQ
Can we be certified to ISO/IEC 27019 alone?
No. ISO/IEC 27019 is a sector control set. Its controls are implemented within an ISO/IEC 27001 ISMS, and certification bodies can assess them as part of the ISO/IEC 27001 audit.
Does it cover gas, oil and heat as well as electricity?
Yes. The 2024 edition covers control and monitoring of production, transmission, storage and distribution of electric power, gas, oil and heat.
Our OT team and IT team work separately. Is that a problem?
It is common. We build one ISMS with clear responsibilities for each domain, so controls are consistent without forcing IT practices onto control systems.
Does AEC issue the certificate?
No. Certification is issued by an accredited certification body. AEC prepares your controls and evidence for that assessment.
Secure your energy operations
Tell us your assets, control systems and current ISMS. We reply with a proposal covering control design, implementation and assessment readiness.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.