# Energy Sector Controls Profile (ISO/IEC 27019): [Organization name]

> Sector profile for energy utilities and organizations that run energy
> process control: power, gas, oil and heat generation, transmission,
> storage and distribution, plus smart metering, distributed energy
> resources and charging infrastructure. It records how the sector
> guidance in ISO/IEC 27019:2024 (energy utility industry controls, based
> on ISO/IEC 27002:2022) is applied inside an ISMS that meets
> ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3)
> and the Statement of Applicability. It also shows where IEC 62443
> (industrial automation and control systems security) fits. Replace
> every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when the ISMS scope includes operational technology (OT) in the
  energy domain: control centres, substations, plants, pipelines,
  district heating, smart meters, energy management systems, distributed
  energy resources (DER) or EV charging. Also use it when a regulator or
  a customer (for example a transmission or distribution operator)
  expects controls "in line with ISO/IEC 27019".
- Fill section 3 (OT asset landscape and zones) and section 5 (the
  sector supplement register, from your licensed copy of ISO/IEC 27019)
  first. Sections 6 and 7 then connect each sector topic to Annex A and
  to concrete implementation.
- The main pitfall is treating OT like office IT: patching, scanning and
  forcing passwords on a protection relay can trip a feeder. Every OT
  control decision needs the process engineer and the safety owner in
  the room, and safety always wins over confidentiality.
- ISO/IEC 27019 is a guidance standard. Certification is to
  ISO/IEC 27001; the sector controls enter your SoA as additional
  controls or as sector guidance on Annex A controls.
- This template does not reproduce the sector control list. It gives a
  register to record the controls from your copy and an original
  mapping of energy topics to Annex A.
- Related templates: `compliance/statement-of-applicability`,
  `compliance/risk-methodology`, `compliance/risk-register`,
  `isms/network-security-standard`, `isms/secure-configuration-baseline`,
  `isms/supplier-security-agreement-27036`, `isms/iot-27400-security`,
  `industry/utility-cim-integration-design`,
  `compliance/nis2-security-measures`, `isms/control-framework-crosswalk`.
-->

## Document control

<!-- Guidance: Owned by the person accountable for OT security (often the CISO with an OT security lead). The approvers must include the operations or asset management head, because many controls here change how plants and grids are run. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-108 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@ot-security-lead] |
| Approvers/reviewers | [@ciso], [@head-of-operations], [@safety-manager], [@isms-manager] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential: contains OT architecture details] |
| Standard and edition | ISO/IEC 27019:2024; ISO/IEC 27002:2022; ISO/IEC 27001:2022 + Amd 1:2024 |
| Next scheduled review | YYYY-MM-DD |
| Energy activities in scope | [Generation / Transmission / Distribution / Storage / Gas / Oil / Heat / Metering / DER / Charging] |
| OT sites in scope | [List sites, or refer to DOC-ISMS-002 scope] |
| OT security framework used alongside | [IEC 62443 series / NERC CIP / National framework / None] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| OT security lead (author) | [@ot-security-lead] | [Prepared] | YYYY-MM-DD |
| Head of operations or asset management | [@head-of-operations] | [Approved] | YYYY-MM-DD |
| Safety manager | [@safety-manager] | [Reviewed: no safety conflict] | YYYY-MM-DD |
| CISO | [@ciso] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@ot-security-lead] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. ISO/IEC 27019 at a glance](#2-isoiec-27019-at-a-glance)
- [3. OT asset landscape and zones](#3-ot-asset-landscape-and-zones)
- [4. Applicability decision](#4-applicability-decision)
- [5. Sector supplement register](#5-sector-supplement-register)
- [6. Mapping of energy topics to Annex A](#6-mapping-of-energy-topics-to-annex-a)
- [7. Implementation table](#7-implementation-table)
- [8. OT considerations and IEC 62443](#8-ot-considerations-and-iec-62443)
- [9. Worked risk example](#9-worked-risk-example)
- [10. Regulatory examples](#10-regulatory-examples)
- [11. Size tiers](#11-size-tiers)
- [12. Records and evidence](#12-records-and-evidence)
- [13. References](#13-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: State which energy activities and which OT systems this profile covers, and what is out of scope. Auditors check that the ISMS scope statement (DOC-ISMS-002) and this profile describe the same boundary. -->

This profile explains how [Organization name] protects the information
and systems that control and monitor its energy processes. It:

- lists the OT systems, sites and zones in scope (section 3);
- records which sector-specific controls from ISO/IEC 27019:2024 apply
  and why (sections 4 and 5);
- maps each energy topic to the ISO/IEC 27001:2022 Annex A controls that
  carry it in the Statement of Applicability, DOC-ISMS-011 (section 6);
- assigns owners, status and evidence to each implementation item
  (section 7).

In scope: [control centres, substations, generating plants, compressor
or pumping stations, heat plants, metering head-end systems, DER and
charging back-ends, remote maintenance access, engineering
workstations].

Out of scope: [office IT already covered by the general ISMS policies,
nuclear process control]. ISO/IEC 27019:2024 states that it does not
cover the process control domain of nuclear facilities, which is
addressed by IEC 63096. If you operate nuclear assets, follow that
standard and your nuclear regulator for those systems.

## 2. ISO/IEC 27019 at a glance

<!-- Guidance: Give readers the minimum they need to understand where the standard sits. Do not copy its text: describe it in your own words and point to the licensed copy kept by the document owner. -->

| Question | Answer for this profile |
|---|---|
| What it is | Sector guidance: information security controls for the energy utility industry, built on the ISO/IEC 27002:2022 control set |
| Edition | ISO/IEC 27019:2024 (second edition, published 2024-10-18, replaces the 2017 edition) |
| Certifiable? | No. Certification is to ISO/IEC 27001:2022 + Amd 1:2024. The sector controls inform risk treatment and the SoA |
| Systems it addresses | Process control and automation technology, PLCs and field devices, supporting systems such as historians and visualization, telecontrol and process networks, smart metering, emission measurement, protection and safety systems, energy management systems for DER, charging and customer installations, related software, premises and remote maintenance (summarised from the public scope) |
| How it is organised | In line with the four themes of ISO/IEC 27002:2022 (organizational, people, physical, technological). It adds energy-specific guidance to existing controls and, as the 2017 edition did, energy-specific controls of its own. Check your copy for the exact list, numbering and any annexes |
| Who reads it | OT security leads, control engineers, asset managers, ISMS managers, auditors familiar with the energy domain |
| Licensed copy held by | [@ot-security-lead], [document repository path] |

How the pieces fit:

```mermaid
flowchart LR
  A["ISO/IEC 27001:2022 + Amd 1:2024: ISMS requirements"] --> B["Risk assessment and treatment (6.1.2, 6.1.3)"]
  C["ISO/IEC 27002:2022: control guidance"] --> B
  D["ISO/IEC 27019:2024: energy sector guidance"] --> B
  E["IEC 62443: IACS security"] --> B
  B --> F["Statement of Applicability DOC-ISMS-011"]
  F --> G["Implementation table, section 7"]
```

## 3. OT asset landscape and zones

<!-- Guidance: You cannot protect what you have not listed. Start from the asset inventory (DOC-ISMS-012) and add OT-specific attributes: safety function, vendor, firmware, remote access path, zone. An auditor will pick one field device and ask where it appears in the inventory, the zone model and the risk register. -->

### 3.1 OT asset classes

| Asset class | Examples | Owner | Zone | Safety relevant? | Count |
|---|---|---|---|---|---|
| Control centre systems | [SCADA, energy management system, distribution management system, outage management system] | [@control-centre-manager] | [Z3 control centre] | [Yes / No] | [n] |
| Field controllers *(Example)* | PLCs and remote terminal units at 3 plants | Plant engineering | Z1 field | Yes | 42 |
| Protection and safety systems | [Protection relays, safety PLCs, governors] | [@protection-engineer] | [Z1 field] | Yes | [n] |
| Supporting systems | [Historian, engineering workstations, HMI] | [@ot-engineering] | [Z2 site supervisory] | [Yes / No] | [n] |
| Telecontrol and process networks | [Fibre, radio, cellular links, telecontrol gateways] | [@ot-network-lead] | [Conduits] | [Yes / No] | [n] |
| Metering | [Smart meters, head-end system, meter data management] | [@metering-manager] | [Z2 / IT-OT DMZ] | [No] | [n] |
| DER and charging back-ends | [Solar inverters, battery management, charging station management] | [@der-manager] | [Z2 / cloud] | [Yes / No] | [n] |
| Remote maintenance | [Vendor access gateways, jump hosts] | [@ot-security-lead] | [IT-OT DMZ] | [No] | [n] |

### 3.2 Zone model

Use the same zone names as the network security standard (DOC-ISMS-063).
Each arrow below is a conduit: an allowed, documented and monitored
communication path.

```mermaid
flowchart TD
  IT["Enterprise IT zone"] --> DMZ["IT-OT DMZ: historian replica, jump host, patch staging"]
  VEND["Vendor remote maintenance"] --> DMZ
  DMZ --> CC["Z3 control centre: SCADA, EMS, DMS"]
  CC --> SUP["Z2 site supervisory: HMI, engineering workstations"]
  SUP --> FLD["Z1 field: PLCs, RTUs, protection relays"]
  SAF["Z0 safety systems"] -. "read only status" .-> SUP
```

Rules for the zone model:

1. No direct path from enterprise IT or the internet to Z1 or Z0.
2. Vendor access ends in the DMZ and needs a per-session approval.
3. Safety systems (Z0) send status outward only; no inbound write path.
4. Every conduit has an owner, a rule set and a review date in the
   firewall rule review (`security/firewall-rule-review`).

## 4. Applicability decision

<!-- Guidance: Decide, for each energy-specific control and for the sector guidance on each Annex A control, whether it applies. Write the reason. "Not applicable" is acceptable when the matching activity does not exist, never because a control is hard. -->

Apply this decision to every entry in section 5 and record the result
in the SoA.

```mermaid
flowchart TD
  S["Sector control or guidance item"] --> Q1{"Does the related activity or system exist in scope?"}
  Q1 -- "No" --> NA["Not applicable: record the reason in the SoA"]
  Q1 -- "Yes" --> Q2{"Does a risk, law or contract call for it?"}
  Q2 -- "No" --> JUST["Not selected: record the risk-based reason and review yearly"]
  Q2 -- "Yes" --> Q3{"Safety impact if implemented as written?"}
  Q3 -- "Yes" --> ENG["Engineering review with safety owner, choose compensating design"]
  Q3 -- "No" --> IMP["Select and implement, add to section 7"]
  ENG --> IMP
```

Decision record fields: entry ID, decision, reason (risk ID, legal
reference from DOC-ISMS-014, contract clause), decision maker, date.

## 5. Sector supplement register

<!-- Guidance: Fill this from your licensed copy of ISO/IEC 27019:2024. Use the standard's own control numbers in the "Reference in 27019" column, but write the short label and the description in your own words. Do not paste control text: it is copyrighted and your auditor only needs the reference and your implementation. -->

Two kinds of entries:

- **Energy-specific controls**: controls the sector standard adds to the
  ISO/IEC 27002 set. Record them as additional controls in the SoA.
- **Sector guidance on existing controls**: extra implementation
  guidance on a control that is already in Annex A. Record it in the
  implementation notes of that Annex A row.

| Entry ID | Reference in 27019 | Type | Your short label | Related Annex A | Applicable | Section 7 item |
|---|---|---|---|---|---|---|
| ENR-REG-001 *(Example)* | [ENR control number from your copy] | Energy-specific control | Security of control centre premises | A.7.1, A.7.2, A.7.3 | Yes | ENR-IMP-004 |
| ENR-REG-002 *(Example)* | [ENR control number from your copy] | Energy-specific control | Protection of unattended peripheral sites | A.7.1, A.7.4 | Yes | ENR-IMP-005 |
| ENR-REG-003 *(Example)* | [ENR control number from your copy] | Energy-specific control | Handling legacy systems that cannot be patched | A.8.8, A.8.22 | Yes | ENR-IMP-002 |
| ENR-REG-004 *(Example)* | [Number from your copy] | Guidance on existing control | Remote maintenance of process control systems | A.5.19, A.8.2, A.8.5 | Yes | ENR-IMP-001 |
| ENR-REG-005 | [Number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [ENR-IMP-nnn] |
| ENR-REG-006 | [Number from your copy] | [Type] | [Your label] | [A.x.y] | [Yes / No] | [ENR-IMP-nnn] |

The example labels describe common energy topics. Confirm that each one
corresponds to an entry in your copy before keeping it, and add a row
for every energy-specific control listed there.

## 6. Mapping of energy topics to Annex A

<!-- Guidance: This mapping is the template's own analysis of typical energy topics, not a table from the standard. Use it to check that your SoA covers each topic, and adjust it to your systems. -->

| Energy topic | Primary Annex A controls (short labels) | Notes for OT |
|---|---|---|
| Process control asset inventory | A.5.9 inventory of information and assets | Include firmware versions, vendor, safety function, zone |
| Classification of OT information | A.5.12 information classification, A.5.13 information labelling | Network diagrams, setpoints and protection settings are confidential |
| Supplier and OEM relationships | A.5.19, A.5.20, A.5.21, A.5.22 supplier relationships and ICT supply chain | OEM service contracts must cover remote access, patch support, end of life |
| Remote maintenance | A.5.15 access control rules, A.8.2 privileged access rights, A.8.5 secure authentication | Session approval, MFA at the DMZ, recording, time limits |
| Incident response in OT | A.5.24 to A.5.28 incident management | Joint playbooks with control room; manual operation fallback |
| Operation during disruption | A.5.29 security during disruption, A.5.30 ICT readiness for business continuity | Black start, island operation, backup control centre |
| Legal and regulatory duties | A.5.31 legal, regulatory and contractual requirements | Sector regulator, NIS2, network codes, NERC CIP where applicable |
| OT operating procedures | A.5.37 documented operating procedures | Switching orders, change windows, emergency procedures |
| Competence of OT staff | A.6.3 awareness, education and training | Role-based training for control room and field engineers |
| Control centres and substations | A.7.1 to A.7.4 perimeters, entry, secure areas, monitoring | Unattended sites need intrusion detection and alarm response |
| Environmental and utility protection | A.7.5 physical and environmental threats, A.7.11 supporting utilities | Flooding, fire, UPS and auxiliary supply for protection systems |
| Field device maintenance | A.7.13 equipment maintenance | Authorised maintainers, firmware integrity check |
| Endpoint hardening | A.8.1 user endpoint devices, A.8.9 configuration management | Engineering laptops dedicated to OT, application allow-listing |
| Malware protection | A.8.7 protection against malware | Allow-listing where antivirus is not vendor-approved; removable media kiosks |
| Vulnerability and patch management | A.8.8 technical vulnerability management | Vendor-qualified patches only, compensating controls for legacy |
| Backup of configurations | A.8.13 information backup | PLC programs, relay settings, SCADA databases; tested restores |
| Redundancy | A.8.14 redundancy of processing facilities | Redundant control centre, dual communication paths |
| Logging and monitoring | A.8.15 logging, A.8.16 monitoring activities, A.8.17 clock synchronization | Passive OT network monitoring; time sync matters for protection event analysis |
| Network segregation | A.8.20 network security, A.8.21 network services, A.8.22 network segregation | Zones and conduits as in section 3.2 |
| Telecontrol protocol security | A.8.24 use of cryptography, A.8.20 network security | Secure protocol profiles where devices support them |
| Engineering and change | A.8.25, A.8.27 secure development and architecture, A.8.32 change management | Factory and site acceptance tests include security tests |
| Testing without disruption | A.8.29 security testing, A.8.34 protecting systems during audit testing | No active scanning in Z1 without engineering approval |

## 7. Implementation table

<!-- Guidance: One row per implementation item. Link back to the register entry and to the risk ID. The "Evidence" column must name a record an auditor can sample, not a general statement. -->

| Item ID | Register entry | What is done | Owner | Status | Due | Evidence |
|---|---|---|---|---|---|---|
| ENR-IMP-001 *(Example)* | ENR-REG-004 | Vendor remote access through DMZ jump host with MFA, per-session approval by control room, recording kept 90 days | OT security lead | Implemented | 2027-03-31 | Access approval log, session recordings, quarterly access review |
| ENR-IMP-002 *(Example)* | ENR-REG-003 | 11 legacy HMIs that cannot be patched isolated in a dedicated segment with allow-listed flows only, replacement budgeted | Plant engineering | Partial | 2027-09-30 | Firewall rule review FRR-2027-02, capital plan line |
| ENR-IMP-003 *(Example)* | Annex A A.8.13 guidance | Monthly offline backup of PLC programs and relay settings, restore test twice a year | OT engineering | Implemented | 2027-02-28 | Backup log, restore test report (DOC-ISMS-071) |
| ENR-IMP-004 *(Example)* | ENR-REG-001 | Two-factor entry at the control centre, visitor escort, CCTV with 30-day retention | Facilities | Implemented | 2027-01-31 | Badge logs, CCTV retention record |
| ENR-IMP-005 *(Example)* | ENR-REG-002 | Intrusion alarms at 6 unattended substations linked to the control room, response within the agreed time | Field operations | Planned | 2027-12-31 | Alarm test records |
| ENR-IMP-006 | [ENR-REG-nnn] | [Action] | [@owner] | [Planned / Partial / Implemented] | YYYY-MM-DD | [Record] |

Status summary *(Example)*: 6 items in this table, of which 3 are
implemented, 1 partial, 1 planned and 1 blank row awaiting entries.
Report the counts in the ISMS performance report (DOC-ISMS-081).

## 8. OT considerations and IEC 62443

<!-- Guidance: Use this section to record the engineering rules that make the controls safe in OT. Auditors with an OT background check that office-IT controls were adapted, not copied, and that safety and availability priorities are written down. -->

### 8.1 Priorities

In OT the usual order of protection goals changes. Write your order and
apply it to every decision in sections 4 to 7:

1. Safety of people and the environment.
2. Availability and integrity of the physical process.
3. Integrity of control data and settings.
4. Confidentiality of operational and customer information.

### 8.2 Engineering rules

| Rule ID | Rule | Reason |
|---|---|---|
| OT-RULE-001 *(Example)* | No active vulnerability scans in Z1 or Z0 during operation; use passive monitoring and vendor advisories | Scans can crash older controllers |
| OT-RULE-002 *(Example)* | Patches installed only after vendor qualification and a test on a reference system | Unqualified patches can void safety certification |
| OT-RULE-003 *(Example)* | Emergency access ("break glass") accounts exist for control room operators and are reviewed after each use | Operators must never be locked out during an incident |
| OT-RULE-004 *(Example)* | Removable media only through a scanning kiosk in the DMZ | Removable media remain a common OT infection route |
| OT-RULE-005 | [Rule] | [Reason] |

### 8.3 Using IEC 62443 alongside ISO/IEC 27019

The IEC 62443 series addresses security for industrial automation and
control systems (IACS). It is developed jointly by the ISA99 committee and
IEC TC 65 and published by IEC (and by ISA as ANSI/ISA-62443). Use it where
ISO/IEC 27019 tells you what to protect and you need technical depth on
how. Commonly used parts (check current editions with the publisher):

| Part | Topic | How this profile uses it |
|---|---|---|
| IEC 62443-2-1 | Security programme for IACS asset owners | Cross-check of sections 4 to 7 with the asset owner programme |
| IEC 62443-2-4 | Requirements for IACS service providers | Clauses in OEM and integrator contracts (DOC-ISMS-068) |
| IEC 62443-3-2 | Risk assessment, zones and conduits | Method behind the zone model in section 3.2 |
| IEC 62443-3-3 | System security requirements and security levels | Target security level per zone |
| IEC 62443-4-1 and 4-2 | Secure product development and component requirements | Procurement requirements for new devices |

Other energy references to consider: IEC 62351 for power system
communication security, IEC 63096 for nuclear facilities, and the
national or regional energy frameworks listed in section 10.

## 9. Worked risk example

<!-- Guidance: Show one risk end to end, using the scale in DOC-ISMS-010 (likelihood 1 to 5 times impact 1 to 5; Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25)). This example helps readers see how a sector control becomes a treatment. -->

*Example:* Quillmere Group (2,400 staff, 6 sites in 4 countries, OT and
IT) runs combined heat and power units and rooftop solar at its 3
plants. These are energy management and DER systems, which fall within
the systems ISO/IEC 27019 addresses even though the group is a
manufacturer, not a utility.

| Field | Value |
|---|---|
| Risk ID | R-071 *(Example)* |
| Scenario | The CHP unit's OEM connects through an always-on remote access router at Plant 2. Stolen OEM credentials allow an attacker to change setpoints |
| Inherent likelihood x impact | 4 x 5 = 20, Critical |
| Treatment | ENR-IMP-001 (remote access through DMZ jump host, MFA, per-session approval, recording); OT-RULE-003; OEM contract clause for credential management |
| Residual likelihood x impact | 2 x 5 = 10, High |
| Acceptance | High residual risk accepted by top management with treatment in place (DOC-ISMS-019 record ACC-071 *(Example)*) |
| Review | Every 6 months, or after any OEM access incident |

## 10. Regulatory examples

<!-- Guidance: List only the frameworks that apply to you, with the reference kept in the legal register (DOC-ISMS-014). These are international examples; check the official text and your regulator's guidance. This is a documentation format, not legal advice. -->

| Framework | Region | Relevance | Check |
|---|---|---|---|
| Directive (EU) 2022/2555 (NIS2) | EU | Energy (electricity, district heating and cooling, oil, gas, hydrogen) is a sector of high criticality; risk management measures and incident reporting | National transposition law and competent authority |
| Commission Delegated Regulation (EU) 2024/1366, network code on cybersecurity aspects of cross-border electricity flows | EU | Sector-specific cybersecurity rules for high-impact and critical-impact electricity entities | Consolidated text on EUR-Lex (amended 2025) |
| NERC CIP reliability standards | North America | Mandatory cybersecurity standards for the bulk electric system | Current versions on the NERC website |
| [National energy regulator rules] | [Country] | [Licence conditions, security requirements] | [Source] |

## 11. Size tiers

<!-- Guidance: The library uses three working tiers. The fictional settings give a size reference; adapt the energy role to your own. Show what changes per tier so a small operator does not copy a group-level programme. -->

| Aspect | Small (under 50 people) | Medium (50 to 500) | Large or multi-site (over 500 or several sites) |
|---|---|---|---|
| Size reference | Quillmere Analytics Ltd, 46 staff (38 employees, 8 contractors), part-time ISMS manager | Quillmere Health Systems, 320 staff, full-time ISMS manager and 3-person security team | Quillmere Group, 2,400 staff, 6 sites in 4 countries, CISO and 14-person security office |
| Typical energy role *(Example)* | Analytics or software supplier handling smart meter or DER data for utilities, no own OT | Regional distribution operator, DER aggregator or charging network operator of similar size | Integrated utility, or a manufacturer with own generation and energy management at several plants |
| Use of ISO/IEC 27019 | Selected entries on metering data, supplier duties and remote access to customer systems | Most entries, one OT zone model, OT security lead role | Full register per site, group OT security standard, IEC 62443 security levels per zone |
| OT governance | ISMS manager plus customer requirements | OT security lead reporting to the ISMS manager | OT security function inside the security office, site OT coordinators |
| Monitoring | Customer-provided or none (no OT) | Passive OT monitoring at the control centre | Passive monitoring at every site feeding a central SOC |
| Review cycle | Yearly | Yearly plus after major changes | Yearly per site, rolling group review |

## 12. Records and evidence

<!-- Guidance: Name the records that prove the profile operates. Map them in the control evidence matrix (isms/control-evidence-matrix) and set retention in the documented information register. An auditor will sample one record per row. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| OT asset inventory extract | Asset classes and zones in section 3 are current | OT engineering | [CMDB / OT asset tool] | [Current plus 3 years of snapshots] |
| Zone and conduit diagram with review date | Segregation design | OT network lead | [Document repository] | [Superseded versions 3 years] |
| Sector supplement register and SoA rows | Applicability decisions | ISMS manager | [ISMS repository] | [Life of the ISMS plus 3 years] |
| Remote access approvals and session recordings | ENR-IMP-001 operates | OT security lead | [Jump host logs] | [Example: 90 days recordings, 1 year approvals] |
| Patch qualification and change records | A.8.8 and A.8.32 in OT | OT engineering | [Change tool] | [Example: 3 years] |
| Backup and restore test reports | A.8.13 in OT | OT engineering | DOC-ISMS-071 | [Example: 3 years] |
| Physical access logs for control centres and substations | A.7.2 and A.7.4 | Facilities | [Access control system] | [Example: 1 year] |
| OT incident and exercise reports | Incident readiness in OT | OT security lead | DOC-ISMS-021, exercise folder | [Example: 6 years] |

Link each record to its control in `isms/control-evidence-matrix`
(DOC-ISMS-033).

## 13. References

<!-- Guidance: Keep the editions current. ISO/IEC 27019 aligns with ISO/IEC 27002:2022; when ISO/IEC 27002 changes, check for a new sector edition. -->

| Reference | Edition and status | Use |
|---|---|---|
| ISO/IEC 27019:2024, information security controls for the energy utility industry | Current (https://www.iso.org/standard/85056.html) | Sector controls and guidance |
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | ISMS requirements, clause 6.1.3, Annex A |
| ISO/IEC 27002:2022 | Current (https://www.iso.org/standard/75652.html) | Control guidance the sector standard builds on |
| ISO/IEC 27005:2022 | Current (https://www.iso.org/standard/80585.html) | Risk management guidance |
| IEC 62443 series | Check current editions (cited without link) | IACS security |
| IEC 62351 series, IEC 63096 | Check current editions (cited without link) | Power system communication security, nuclear control systems |
| Directive (EU) 2022/2555 (NIS2) | OJ L 333, 27.12.2022 (https://eur-lex.europa.eu/eli/dir/2022/2555/oj) | Energy sector obligations in the EU |
| Commission Delegated Regulation (EU) 2024/1366 | As amended (https://eur-lex.europa.eu/eli/reg_del/2024/1366/oj) | Electricity network code on cybersecurity |
| Related templates | `compliance/statement-of-applicability`, `compliance/risk-methodology`, `compliance/risk-register`, `compliance/asset-inventory`, `compliance/legal-register`, `isms/network-security-standard`, `isms/secure-configuration-baseline`, `isms/supplier-security-agreement-27036`, `isms/iot-27400-security`, `isms/backup-restore-test-log`, `isms/control-framework-crosswalk`, `isms/control-evidence-matrix`, `security/firewall-rule-review`, `industry/utility-cim-integration-design`, `compliance/nis2-security-measures` | Linked documents |

## Standard and licence note

Structure aligned with ISO/IEC 27019:2024 and ISO/IEC 27001:2022 + Amd
1:2024 (clause 6.1.3 and Annex A). The register, mapping, rules and
examples are original. No text, control wording, tables or definitions
from ISO, IEC or ISA standards are reproduced; the scope summary is a
short paraphrase of the public catalogue description. You need your own
licensed copy of ISO/IEC 27019 to fill section 5. Check the current
editions before use, including the IEC 62443 parts. Official ISO text,
purchase or licensed access: https://www.iso.org/standard/85056.html and
https://www.iso.org/standard/82875.html. Regulatory summaries are short
paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.