ISO 27001 for energy utilities with ISO 27019

Can an energy utility use ISO 27001 with ISO 27019 for OT security?

Yes. A utility can run an ISO 27001 ISMS that covers its process control systems, because ISO/IEC 27019:2024 adds energy-specific controls on top of ISO/IEC 27002:2022 for the control and monitoring of electric power, gas, oil and heat generation, transmission, storage and distribution. The edition is the second of the standard, was published on 18 October 2024, and is 39 pages long. The utility's ISMS scope, set under clause 4.3 of ISO/IEC 27001:2022, and its Statement of Applicability, required by clause 6.1.3 d), decide which systems, sites and suppliers are covered and which controls apply to them. When a customer, regulator or board asks for ISO 27001 while operational technology (OT) sits on the same network as corporate IT, the first decision is therefore not which certificate to buy but which systems the scope must include.

The roles need to stay clear. The utility owns its controls, owns the risk decisions and signs the Statement of Applicability. An implementation partner can prepare the network architecture, asset inventories, configuration baselines and evidence, but cannot issue the certificate. Only an independent accredited certification body can audit the ISMS and grant certification. Check that the certification body's accreditation covers the energy sector and that the auditors have relevant OT experience. Also confirm with the body how it will sample process control sites, since audit scope follows the documented ISMS scope rather than what the utility would prefer to show.

Out-of-scope items must be stated plainly. ISO/IEC 27019:2024 does not apply to the process control domain of nuclear facilities, which IEC 63096 covers, so a utility with nuclear generation should confirm with the standards bodies and its regulator which framework governs those systems. Where a utility operates both nuclear and non-nuclear assets, the scope document should separate them explicitly. An ISO 27001 certificate also does not by itself demonstrate NIS2 compliance, so utilities subject to that directive should map their obligations separately, as the ENISA mapping of Implementing Regulation 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence.

Where ISO 27019 scope starts and stops

ISO/IEC 27019:2024 covers the control and monitoring of energy generation, transmission, storage and distribution, but the boundary around those assets is a decision the organization makes and must justify. The cards below set out the components that sit inside or outside that boundary and the evidence to hold for each one.

Process control domain in scope

The process control domain is the core of the energy-specific scope: the systems that monitor and control generation, transmission, storage and distribution of electric power, gas, oil and heat. Decide which control centers, substations, plants and their supervisory systems fall inside the ISMS boundary, and record the reason for each inclusion in the scope statement. Hold asset inventories, network diagrams and the rationale that ties each system to a controlled process.

Supporting IT systems

Billing, customer data, HR platforms and corporate networks are supporting systems that the ISMS must address through the general ISO/IEC 27002 controls, even where they sit outside the energy-specific process control domain. Decide whether each system is in scope, and check how it connects to operational systems, since shared directories and file transfers often create the path an attacker would use. Hold access reviews, data flow records and the scope justification for each system.

Nuclear facility process control

ISO/IEC 27019:2024 does not apply to the process control domain of nuclear facilities, which IEC 63096 covers. Operators with nuclear generation must confirm early which standard governs each facility and document that boundary in the scope statement. Ask the certification body how it will treat a mixed portfolio so that nuclear systems are not assumed to be covered by the energy standard.

Third-party OT vendors and remote access

Vendors that maintain turbines, protection relays or SCADA components often hold remote maintenance paths into the process control domain. Decide whether these vendors and their access routes fall within the ISMS boundary, and whether their controls are assessed under the supplier relationship controls. Hold vendor access logs, session recordings, contract clauses on security obligations and records of how access is approved and revoked.

Generation, transmission, storage and distribution assets

The standard reaches across four asset types: generation, transmission, storage and distribution, and it covers electric power, gas, oil and heat. Each asset type can carry different owners, operators and network architectures, so map them separately rather than treating the estate as one block. Hold an asset register that lists each site and its controlled process, and confirm which asset types the organization actually operates before writing the scope.

Interfaces with telecoms and cloud services

Utilities often rely on telecom carriers for communications links and on cloud services for historians, analytics and remote monitoring. Each interface is a boundary question: who controls the link, who runs the service, and where the responsibility for each control sits. Decide how these providers are treated in the Statement of Applicability, and hold their contracts, their own certificates where they exist, and records of how responsibilities are split.

How operational technology fits the ISMS scope and Statement of Applicability

Clause 4.3 of ISO/IEC 27001:2022 requires the organization to determine the boundaries and applicability of its information security management system. The scope is not written in isolation. It follows the organization's work under clause 4.1, which covers internal and external issues, and clause 4.2, which covers interested parties and their requirements. For an energy utility, those inputs usually include the regulator, grid or network operator obligations, and customer or contractual requirements that reach into generation, transmission, distribution or supporting business systems. The compliance lead should trace each requirement back to the systems it touches before drawing the boundary.

Start from the inputs: Record the clause 4.1 and 4.2 findings that justify including or excluding OT environments.
Name the business processes: Describe the scope by process and location, such as control of a named generation or distribution function, not only by a list of networks.
Address the supporting processes: ISO/IEC 27019:2024 also covers supporting processes, so billing, metering data and maintenance functions need an explicit position.
Record the nuclear boundary: ISO/IEC 27019 does not apply to nuclear process control, which IEC 63096 covers, so state where that domain sits.
Keep the scope statement short: The certificate will carry the scope wording, so make it precise enough for an assessor to test.

Before approval, confirm with the certification body how it expects an OT boundary to be described on the certificate.

How an energy utility gets from scope to certificate

The sequence turns a utility's context, regulatory obligations and operational technology estate into a defined ISMS, a risk-based Statement of Applicability and evidence that controls work, ready for an accredited certification body to test. Each phase closes with a written output that the next phase depends on.

Define context and interested parties
Leadership records the external and internal issues that affect the utility, including the regulators, grid operators, transmission and distribution system operators, generation partners, gas or heat network counterparts and critical suppliers whose requirements shape the ISMS. Clause 4.1 and 4.2 of ISO/IEC 27001:2022 make this a formal step, so the list of interested parties and their requirements should be written down and reviewed by someone who can speak for regulatory obligations. The output is a signed context record that the scope decision can cite. The step is done when each external requirement has a named owner and a source document the assessor can read.
Set the ISMS and OT scope
The organization decides which business units, sites, control and monitoring systems, and supporting processes fall inside the ISMS, using clause 4.3 as the rule. Energy-sector teams should draw the boundary between corporate IT, operational technology (OT) used to control generation, transmission, storage and distribution, and any process control domain that belongs to a different standard, such as nuclear facilities covered by IEC 63096 and excluded from ISO/IEC 27019:2024. Interfaces with third-party operators and shared control centers need explicit treatment. The output is a scope statement with a boundary diagram, an asset inventory for the in-scope OT networks, and a short list of exclusions with reasons.
Assess information security risks
The risk owner identifies threats and vulnerabilities to the in-scope assets, estimates likelihood and impact, and sets risk acceptance criteria. ISO/IEC 27005:2022 is a useful reference for the method, and energy teams often combine it with the consequences of loss of supply, safety impacts and grid stability, which their operators already model. Asset owners in operations need to take part, because a risk to a substation controller is assessed differently from a risk to a finance database. The output is a risk register that links each risk to an asset, an owner and a rated level, and a risk treatment plan that lists the decisions taken for each risk.
Write the Statement of Applicability
Clause 6.1.3 d) requires a Statement of Applicability that lists the Annex A controls, states whether each is applicable, and gives the justification for inclusion or exclusion. Energy utilities add the ISO/IEC 27019:2024 controls on top of the ISO/IEC 27002:2022 baseline, so the document must show both sets and say how each sector control is applied, or why it does not apply. The information security officer writes the statement from the risk treatment decisions, and the executive sponsor approves it. The output is an approved Statement of Applicability with a version number that matches the scope statement, and the step is complete when every risk in the register traces to at least one control.
Implement and evidence the controls
Control owners in IT, OT engineering, operations and suppliers implement the selected controls and produce evidence that they run. For OT this often means hardened configurations for control and monitoring systems under A.8.9 Configuration management, access records for remote and vendor sessions, logs from segmented networks, and documented change approvals for engineering workstations. Where tooling is self-hosted, configuration files and logs should be retained under change control so the evidence is reproducible. The output is an evidence register that maps each applicable control to the artifacts that show it operates, with dates, owners and locations. The step is done when a person outside the control team can follow the trail for each control.
Run the internal audit
The organization audits its own ISMS against clauses 4 to 10 and the applicable Annex A controls, using auditors who are independent of the areas they examine. For energy utilities, the internal audit should test OT controls on the plant side as well as in corporate IT, including whether the scope boundary is respected in practice. Findings are classified, owners are assigned and corrective actions are tracked to closure. The output is an internal audit report with a list of nonconformities, corrective action records and evidence that each action was verified. The step is complete when the open items are either closed or formally accepted by management.
Hold management review
Top management reviews the ISMS at planned intervals, covering the status of actions from earlier reviews, changes in external and internal issues, feedback from interested parties, risk assessment results, audit findings, incidents and opportunities for improvement. Regulatory changes and grid events should appear in the agenda when they affect risk or scope. The output is minutes that record decisions, resource commitments and changes to the risk treatment plan or Statement of Applicability. The step is complete when the minutes show leadership made decisions and the ISMS owner has the authority to act on them.
Pass the certification body stage audits
The accredited certification body runs its audit in stages, first reviewing documentation such as the scope, risk assessment and Statement of Applicability, then testing implementation and operation on site, including OT areas where the scope requires it. The certification body is independent and issues the certificate, not the implementation partner or the utility's consultants. Findings are raised as nonconformities that must be corrected before a decision is made. The output is an audit report and, if the decision is positive, a certificate whose scope names the in-scope sites and systems. The utility should confirm with its certification body how it will handle OT access, safety rules and sensitive network information during the visit.

What an OT-heavy utility must have in place before the audit

An ISO 27001 assessor testing an energy utility will start from the ISMS scope and work outward to the control systems inside it. The six items below are the records that connect that scope to operational technology, so an internal review can find gaps before an external auditor does.

OT asset inventory tied to scope

Every programmable device, historian, human-machine interface and engineering workstation inside the declared ISMS scope should appear in one inventory with its owner, site, function and network zone. Check that the inventory matches the scope statement in clause 4.3 and the assets referenced in your risk assessment. An illustrative gap: a substation relay listed in the network diagram but missing from the asset register, which an assessor will notice when sampling.

Configuration baselines for control systems

Document the approved security configuration for each class of control system component, covering firmware versions, enabled services, account settings and logging. A.8.9 asks that these configurations are established, documented, implemented, monitored and reviewed. Internally, pick a sample of field devices and compare their live settings against the baseline to confirm the baseline reflects reality.

Remote and vendor access records

Maintain a log of every remote session into OT networks, showing who connected, which vendor or employee account they used, the approval, the systems reached and the session duration. Vendors often hold standing access, so confirm that each account has a named owner and an expiry. Check whether any access path bypasses the jump host or session recording you describe in your access control procedures.

OT incident handling linked to corporate process

An OT incident, such as unexpected controller behavior or a suspected intrusion into a substation network, should follow the same classification, escalation and reporting path as an IT incident, with added steps for operations staff who can halt or isolate equipment. Run a tabletop exercise that starts in a control room and confirm that the decision to isolate a segment is documented and reachable from the corporate incident process.

Segregation evidence between IT and OT

Keep current network diagrams, firewall rule sets and change records showing how IT and OT zones are separated, along with the conduits that cross between them. Auditors look for evidence that the boundary is enforced, not only drawn. Internally, test one cross-zone path from a corporate workstation to see whether it is blocked, and retain the result with the date and the rule that applied.

Reviewed Statement of Applicability

The Statement of Applicability must justify, for each Annex A control, whether it applies to OT, supporting systems or both, and where it is excluded. Required under clause 6.1.3 d) of ISO/IEC 27001:2022, it should cite ISO/IEC 27019 controls where they add energy-specific detail. Before the audit, have an engineer and a compliance lead each review the OT rows, and confirm every excluded control has a documented reason tied to the risk treatment plan.

Why an ISO 27001 certificate does not by itself show NIS2 compliance

An ISO 27001 certificate does not, on its own, demonstrate compliance with the NIS2 Directive. ENISA's mapping of Implementing Regulation 2024/2690 to ISO/IEC 27001:2022 does not measure equivalence between the two. It shows where topics overlap, such as risk assessment, access control, supplier relationships and incident handling, but it does not establish that a certified ISMS meets each technical requirement the regulation sets. A utility in NIS2 scope should therefore treat its ISO 27001 certificate as one input to its compliance position, not as the position itself. The practical step is a separate gap check against Implementing Regulation 2024/2690 and the risk-management measures in the NIS2 Directive. The check should run requirement by requirement and record, for each one, the policy, technical setting, owner and evidence that satisfies it, including the controls that apply to operational technology in generation, transmission, storage and distribution. Requirements that the ISO 27001 Statement of Applicability does not reference, or references only in general terms, are where the gap usually sits. Confirm the current text of the regulation and the ENISA guidance with the competent national authority and your own legal team before you rely on either.

Incident reporting needs its own workstream because it runs on deadlines that an ISO 27001 audit does not test in the same way. The NIS2 Directive sets out early warning, incident notification and final report obligations for significant incidents, and each national authority applies its own procedures. Your incident management process, on-call roles, logging of operational technology events and contact lists must be able to meet those timings in a real event. Run a tabletop exercise that starts from a detected anomaly in a control system and follows it to a reporting decision, then record who decided, what was sent and when. The exercise output is useful evidence for both the certification body and the supervisory authority. Two decisions follow from the gap check. First, assign a named owner for NIS2 obligations, separate from the ISMS owner if your organization is large enough to do so, so that regulatory duties do not depend on one person's reading of an audit report. Second, decide whether the gap check will be done internally or by an implementation partner. A partner can prepare evidence and test controls, but the organization must own the compliance position and any regulatory submissions. Ask any partner to show how each finding maps to a requirement and to a named owner, and ask for the list of items that will remain with your staff.

Questions utilities ask before hiring help with ISO 27019

Is ISO 27019 mandatory for energy utilities?

No. ISO/IEC 27019:2024 is a voluntary international standard, so using it is a choice unless a contract, a regulator or a national scheme requires it. Many utilities adopt it because a customer, a grid operator or an internal governance decision asks for an ISMS that covers energy-specific controls. Check the obligation first: ask the regulator, the contract owner and procurement which requirement applies, and whether they expect ISO 27001 certification, a conformity statement against ISO 27019, or simply a documented alignment. ISO 27019 adds controls on top of ISO/IEC 27002:2022 for control and monitoring of generation, transmission, storage and distribution of electric power, gas, oil and heat. An ISO 27001 certificate does not by itself show compliance with NIS2 or other energy regulation, so confirm which evidence your regulator accepts before you buy any service.

Can operational technology be left out of the ISMS scope?

Only with a documented, justified exclusion that the certification body accepts, and it is rarely the right answer for a utility. Clause 4.3 of ISO/IEC 27001:2022 requires you to set the ISMS scope based on your internal and external issues and the requirements of interested parties. If control systems, SCADA, substation automation or supporting networks affect the services you deliver, they belong in the analysis, even if they are managed by engineering rather than IT. Exclusions must be explained in the Statement of Applicability and must not leave out assets that the risk assessment shows matter. ISO/IEC 27019 also states it does not apply to the process control domain of nuclear facilities, which IEC 63096 covers. Ask your implementation partner and certification body to review the scope boundary in writing before work starts.

Who pays for an ISO 27019 project and what recurs?

Four parties are usually paid, and each covers a different part of the work. The certification body charges for the audit, including stage 1 and stage 2 audits and recurring surveillance or recertification audits within a three-year cycle, because only an accredited certification body issues the certificate. An implementation partner, if you hire one, is paid for preparing the ISMS, documentation, system configuration, evidence collection and training under a written scope. Tools cost money in licenses, hosting, monitoring or GRC platforms, whether commercial or open source, and open-source components still carry hosting, support and maintenance effort. Internal staff time from operations, engineering, procurement and legal is the largest hidden cost. One-time costs include the gap assessment, risk assessment and initial audit. Recurring costs include surveillance audits, internal audits, management reviews, patching, and the upkeep of evidence. Ask each vendor for a quote that separates these items.

What do operations and engineering teams need to contribute?

They need to supply accurate knowledge of the systems and the work that keeps them running, which is the input the ISMS cannot invent. Operations and engineering staff must describe assets and network zones, document how control and monitoring systems are configured and changed, explain how remote access and vendor maintenance work, and confirm how alarms, incidents and outages are handled. They also review risk assessments with you, because a risk rating that ignores plant conditions will not hold up under audit. Expect time for workshops, asset walkdowns, change record reviews and sign-off on procedures. Safety and availability constraints must be respected, so testing should be planned with the operator, not run on live control networks. Agree on a named engineering owner for each control area before the project starts, so decisions do not stall.

Can a utility run ISO 27019 in-house without outside help?

Yes, a utility can run the work in-house if it has staff who understand both ISO/IEC 27001:2022 and the operational environment. The main requirements are a project owner with authority across IT and engineering, people trained as internal auditors, and time for the risk assessment, Statement of Applicability and evidence routines. Many organizations use outside help for a specific gap, such as a readiness review, a risk method workshop or technical hardening, while keeping ownership of controls and decisions. The organization owns its controls. An implementation partner such as DeployOpen prepares systems, controls and evidence within a fixed scope, but it does not issue audit reports or certificates, and an independent certification body must perform the audit. Decide what to keep in-house by comparing your team's capacity with the work in the risk register, and get the scope agreed in writing before you commit.

How do I confirm a certification body is accredited for ISO 27001?

Check that the certification body holds accreditation from a recognized accreditation body, then confirm the certificate is listed in a public database. ISO states that it does not certify organizations, and accredited ISMS certification bodies operate to ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024. Since 1 January 2026, Global ACI has assumed the roles of the IAF and ILAC, and ISO still points to the IAF CertSearch database for checking accredited certificates. Ask the certification body for its accreditation certificate and scope, and confirm the scope covers ISO/IEC 27001:2022 and the sector you need. Ask whether the auditors have energy sector experience and whether the audit plan includes OT sites. Verify the accreditation status directly with the accreditation body, not only through the vendor's documents.

Who owns the controls, who prepares evidence and who certifies

The utility remains the owner of its information security management system, its operational technology (OT) and its business decisions about risk. No outside party can accept risk on the utility's behalf or decide which process control assets are critical to its grid, pipeline or heat network. The utility's leadership also approves the Statement of Applicability, which records which Annex A controls apply, which are excluded and why, and how each applicable control is implemented.

Scope decisions: The utility sets the ISMS scope under clause 4.3, including which generation, transmission, distribution, storage or heat assets and supporting processes fall inside it, and documents what sits outside.
OT risk acceptance: Operations, engineering and security leaders decide how identified risks to control and monitoring systems are treated, and who accepts residual risk where safety or availability limits the options.
Statement of Applicability approval: Management reviews and approves the Statement of Applicability, including energy-specific controls drawn from ISO/IEC 27019:2024.
Day-to-day operation: Staff run the controls, review access, maintain asset inventories and respond to incidents.
Management review: Leaders review performance and decide on improvements, which must be recorded.

Confirm internally which named role signs each decision and where the approved documents are stored.

How to check an auditor or implementation partner for an energy scope

Start with the certification body, because only it can issue the certificate and its accreditation determines whether the certificate is recognized. Ask the body to confirm that it holds accreditation for ISO/IEC 27001 certification and that its audit team applies ISO/IEC 17021-1:2015 with ISO/IEC 27006-1:2024, the combination IAF MD 29:2024 required all clients to be audited under by 31 March 2026. Check the certificate holder's details in the IAF CertSearch database that ISO points to, and ask whether the auditors assigned to you have worked on operational technology at energy clients. Ask for the auditor's competence record in plain terms, including how they handle control rooms, substations and plant networks where active scanning or testing may be unsafe. If the body cannot answer these questions in writing, treat that as a finding about the engagement.

Independence matters more in energy than in most sectors, because the same firm that designs your OT segmentation should not also judge whether it works. Confirm in writing that the implementation partner and the certification body are separate organizations with no shared advisory role, and that the partner will not sign off on the Statement of Applicability or the risk treatment decisions that the organization must own. The organization keeps accountability for its controls, and the partner's role is to prepare systems, documentation and evidence. Ask the partner how it will handle OT assets in the scope, which evidence it will hand over for each control, and what happens to that evidence after the engagement ends.

Before signing a fixed-scope agreement, ask for a written list of deliverables with acceptance criteria. Useful items include a scope statement that names each OT and supporting system, a gap assessment against the controls you have selected, the configuration baseline records relevant to A.8.9 Configuration management, and the evidence set your assessor will request. Confirm which party performs each task, which systems will be touched, which testing will happen outside production hours and who approves it. DeployOpen works on fixed scope agreed in writing and does not publish a price list, so ask for a quote that follows from that written scope and lists assumptions about site count, OT asset volume and access arrangements. Ask what is one-time work and what recurs, such as surveillance support or evidence refresh. The ISO certification page is a useful starting point for confirming how certification works before you compare proposals.

How DeployOpen prepares an energy utility's ISMS evidence

DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For ISO 27001 with ISO/IEC 27019:2024, we prepare the systems, controls and evidence that the utility's ISMS needs, while the utility owns its controls and an independent certification body issues any certificate.

How we scope

Agree in writing which generation, transmission, storage and distribution systems sit inside the ISMS scope.
Map supporting systems, such as historians, engineering workstations and remote access paths, to the Statement of Applicability.
Record which process control domains are excluded, including nuclear process control covered by IEC 63096, before work starts.

How we build

Configure self-hosted platforms in the utility's cloud accounts, data centers or air-gapped networks against documented security configurations.
Implement logging, access control and change records that produce the evidence the Annex A controls and ISO/IEC 27019 guidance call for.
Test applications, APIs and infrastructure in the environment so gaps are found and closed before an assessor arrives.

How we hand over

Deliver configuration baselines, runbooks and evidence collection procedures that the utility's own staff can operate.
Document each control's implementation, owner and evidence location so an auditor can trace it without outside help.
Confirm with the utility, the standard and its certification body which items remain the organization's responsibility.

How we support

Fixed-scope engagements have deliverables and timelines agreed in writing before work starts, and a quote follows from that scope.
Ongoing support, upgrades, backups and continuous testing are available as a retainer after handover.
Ask any implementation partner to confirm in writing how it supports audit queries and changes to the ISMS over time.