Energy Sector Controls Profile Template (ISO/IEC 27019)

OT asset classes, zone and conduit model, applicability decision, sector supplement register, energy topics mapped to Annex A, implementation table, IEC 62443 use, risk example

СУІБ та ISO/IEC 27001ПовнийISO/IEC 27019:2024; ISO/IEC 27001:2022 + Amd 1:2024 6.1.3 and Annex A (cited only); IEC 62443 (cited)energy 27019 controlsОновлено 1 лист. 2026 р.

Відкрити в редакторіЗавантажити .md

Як використовувати: Use it when the ISMS scope includes energy process control: control centres, substations, plants, smart metering, DER or charging. Fill the OT asset landscape and the sector supplement register from your licensed copy of ISO/IEC 27019 first. The main pitfall is applying office IT controls unchanged to OT, where scanning or patching can trip a process and safety must come first.

Перегляд

Energy Sector Controls Profile (ISO/IEC 27019): [Organization name]

Sector profile for energy utilities and organizations that run energy process control: power, gas, oil and heat generation, transmission, storage and distribution, plus smart metering, distributed energy resources and charging infrastructure. It records how the sector guidance in ISO/IEC 27019:2024 (energy utility industry controls, based on ISO/IEC 27002:2022) is applied inside an ISMS that meets ISO/IEC 27001:2022 + Amd 1:2024, mainly through risk treatment (6.1.3) and the Statement of Applicability. It also shows where IEC 62443 (industrial automation and control systems security) fits. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-108
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@ot-security-lead]
Approvers/reviewers	[@ciso], [@head-of-operations], [@safety-manager], [@isms-manager]
Last updated	YYYY-MM-DD
Classification	[Confidential: contains OT architecture details]
Standard and edition	ISO/IEC 27019:2024; ISO/IEC 27002:2022; ISO/IEC 27001:2022 + Amd 1:2024
Next scheduled review	YYYY-MM-DD
Energy activities in scope	[Generation / Transmission / Distribution / Storage / Gas / Oil / Heat / Metering / DER / Charging]
OT sites in scope	[List sites, or refer to DOC-ISMS-002 scope]
OT security framework used alongside	[IEC 62443 series / NERC CIP / National framework / None]

Approvals

Role	Name	Decision	Date
OT security lead (author)	[@ot-security-lead]	[Prepared]	YYYY-MM-DD
Head of operations or asset management	[@head-of-operations]	[Approved]	YYYY-MM-DD
Safety manager	[@safety-manager]	[Reviewed: no safety conflict]	YYYY-MM-DD
CISO	[@ciso]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@ot-security-lead]	First issue
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and scope
2. ISO/IEC 27019 at a glance
3. OT asset landscape and zones
4. Applicability decision
5. Sector supplement register
6. Mapping of energy topics to Annex A
7. Implementation table
8. OT considerations and IEC 62443
9. Worked risk example
10. Regulatory examples
11. Size tiers
12. Records and evidence
13. References
Standard and licence note

1. Purpose and scope

This profile explains how [Organization name] protects the information and systems that control and monitor its energy processes. It:

lists the OT systems, sites and zones in scope (section 3);
records which sector-specific controls from ISO/IEC 27019:2024 apply and why (sections 4 and 5);
maps each energy topic to the ISO/IEC 27001:2022 Annex A controls that carry it in the Statement of Applicability, DOC-ISMS-011 (section 6);
assigns owners, status and evidence to each implementation item (section 7).

In scope: [control centres, substations, generating plants, compressor or pumping stations, heat plants, metering head-end systems, DER and charging back-ends, remote maintenance access, engineering workstations].

Out of scope: [office IT already covered by the general ISMS policies, nuclear process control]. ISO/IEC 27019:2024 states that it does not cover the process control domain of nuclear facilities, which is addressed by IEC 63096. If you operate nuclear assets, follow that standard and your nuclear regulator for those systems.

2. ISO/IEC 27019 at a glance

Question	Answer for this profile
What it is	Sector guidance: information security controls for the energy utility industry, built on the ISO/IEC 27002:2022 control set
Edition	ISO/IEC 27019:2024 (second edition, published 2024-10-18, replaces the 2017 edition)
Certifiable?	No. Certification is to ISO/IEC 27001:2022 + Amd 1:2024. The sector controls inform risk treatment and the SoA
Systems it addresses	Process control and automation technology, PLCs and field devices, supporting systems such as historians and visualization, telecontrol and process networks, smart metering, emission measurement, protection and safety systems, energy management systems for DER, charging and customer installations, related software, premises and remote maintenance (summarised from the public scope)
How it is organised	In line with the four themes of ISO/IEC 27002:2022 (organizational, people, physical, technological). It adds energy-specific guidance to existing controls and, as the 2017 edition did, energy-specific controls of its own. Check your copy for the exact list, numbering and any annexes
Who reads it	OT security leads, control engineers, asset managers, ISMS managers, auditors familiar with the energy domain
Licensed copy held by	[@ot-security-lead], [document repository path]

How the pieces fit:

3. OT asset landscape and zones

3.1 OT asset classes

Asset class	Examples	Owner	Zone	Safety relevant?	Count
Control centre systems	[SCADA, energy management system, distribution management system, outage management system]	[@control-centre-manager]	[Z3 control centre]	[Yes / No]	[n]
Field controllers (Example)	PLCs and remote terminal units at 3 plants	Plant engineering	Z1 field	Yes	42
Protection and safety systems	[Protection relays, safety PLCs, governors]	[@protection-engineer]	[Z1 field]	Yes	[n]
Supporting systems	[Historian, engineering workstations, HMI]	[@ot-engineering]	[Z2 site supervisory]	[Yes / No]	[n]
Telecontrol and process networks	[Fibre, radio, cellular links, telecontrol gateways]	[@ot-network-lead]	[Conduits]	[Yes / No]	[n]
Metering	[Smart meters, head-end system, meter data management]	[@metering-manager]	[Z2 / IT-OT DMZ]	[No]	[n]
DER and charging back-ends	[Solar inverters, battery management, charging station management]	[@der-manager]	[Z2 / cloud]	[Yes / No]	[n]
Remote maintenance	[Vendor access gateways, jump hosts]	[@ot-security-lead]	[IT-OT DMZ]	[No]	[n]

3.2 Zone model

Use the same zone names as the network security standard (DOC-ISMS-063). Each arrow below is a conduit: an allowed, documented and monitored communication path.

Rules for the zone model:

No direct path from enterprise IT or the internet to Z1 or Z0.
Vendor access ends in the DMZ and needs a per-session approval.
Safety systems (Z0) send status outward only; no inbound write path.
Every conduit has an owner, a rule set and a review date in the firewall rule review (security/firewall-rule-review).

4. Applicability decision

Apply this decision to every entry in section 5 and record the result in the SoA.

Decision record fields: entry ID, decision, reason (risk ID, legal reference from DOC-ISMS-014, contract clause), decision maker, date.

5. Sector supplement register

Two kinds of entries:

Energy-specific controls: controls the sector standard adds to the ISO/IEC 27002 set. Record them as additional controls in the SoA.
Sector guidance on existing controls: extra implementation guidance on a control that is already in Annex A. Record it in the implementation notes of that Annex A row.

Entry ID	Reference in 27019	Type	Your short label	Related Annex A	Applicable	Section 7 item
ENR-REG-001 (Example)	[ENR control number from your copy]	Energy-specific control	Security of control centre premises	A.7.1, A.7.2, A.7.3	Yes	ENR-IMP-004
ENR-REG-002 (Example)	[ENR control number from your copy]	Energy-specific control	Protection of unattended peripheral sites	A.7.1, A.7.4	Yes	ENR-IMP-005
ENR-REG-003 (Example)	[ENR control number from your copy]	Energy-specific control	Handling legacy systems that cannot be patched	A.8.8, A.8.22	Yes	ENR-IMP-002
ENR-REG-004 (Example)	[Number from your copy]	Guidance on existing control	Remote maintenance of process control systems	A.5.19, A.8.2, A.8.5	Yes	ENR-IMP-001
ENR-REG-005	[Number from your copy]	[Type]	[Your label]	[A.x.y]	[Yes / No]	[ENR-IMP-nnn]
ENR-REG-006	[Number from your copy]	[Type]	[Your label]	[A.x.y]	[Yes / No]	[ENR-IMP-nnn]

The example labels describe common energy topics. Confirm that each one corresponds to an entry in your copy before keeping it, and add a row for every energy-specific control listed there.

6. Mapping of energy topics to Annex A

Energy topic	Primary Annex A controls (short labels)	Notes for OT
Process control asset inventory	A.5.9 inventory of information and assets	Include firmware versions, vendor, safety function, zone
Classification of OT information	A.5.12 information classification, A.5.13 information labelling	Network diagrams, setpoints and protection settings are confidential
Supplier and OEM relationships	A.5.19, A.5.20, A.5.21, A.5.22 supplier relationships and ICT supply chain	OEM service contracts must cover remote access, patch support, end of life
Remote maintenance	A.5.15 access control rules, A.8.2 privileged access rights, A.8.5 secure authentication	Session approval, MFA at the DMZ, recording, time limits
Incident response in OT	A.5.24 to A.5.28 incident management	Joint playbooks with control room; manual operation fallback
Operation during disruption	A.5.29 security during disruption, A.5.30 ICT readiness for business continuity	Black start, island operation, backup control centre
Legal and regulatory duties	A.5.31 legal, regulatory and contractual requirements	Sector regulator, NIS2, network codes, NERC CIP where applicable
OT operating procedures	A.5.37 documented operating procedures	Switching orders, change windows, emergency procedures
Competence of OT staff	A.6.3 awareness, education and training	Role-based training for control room and field engineers
Control centres and substations	A.7.1 to A.7.4 perimeters, entry, secure areas, monitoring	Unattended sites need intrusion detection and alarm response
Environmental and utility protection	A.7.5 physical and environmental threats, A.7.11 supporting utilities	Flooding, fire, UPS and auxiliary supply for protection systems
Field device maintenance	A.7.13 equipment maintenance	Authorised maintainers, firmware integrity check
Endpoint hardening	A.8.1 user endpoint devices, A.8.9 configuration management	Engineering laptops dedicated to OT, application allow-listing
Malware protection	A.8.7 protection against malware	Allow-listing where antivirus is not vendor-approved; removable media kiosks
Vulnerability and patch management	A.8.8 technical vulnerability management	Vendor-qualified patches only, compensating controls for legacy
Backup of configurations	A.8.13 information backup	PLC programs, relay settings, SCADA databases; tested restores
Redundancy	A.8.14 redundancy of processing facilities	Redundant control centre, dual communication paths
Logging and monitoring	A.8.15 logging, A.8.16 monitoring activities, A.8.17 clock synchronization	Passive OT network monitoring; time sync matters for protection event analysis
Network segregation	A.8.20 network security, A.8.21 network services, A.8.22 network segregation	Zones and conduits as in section 3.2
Telecontrol protocol security	A.8.24 use of cryptography, A.8.20 network security	Secure protocol profiles where devices support them
Engineering and change	A.8.25, A.8.27 secure development and architecture, A.8.32 change management	Factory and site acceptance tests include security tests
Testing without disruption	A.8.29 security testing, A.8.34 protecting systems during audit testing	No active scanning in Z1 without engineering approval

7. Implementation table

Item ID	Register entry	What is done	Owner	Status	Due	Evidence
ENR-IMP-001 (Example)	ENR-REG-004	Vendor remote access through DMZ jump host with MFA, per-session approval by control room, recording kept 90 days	OT security lead	Implemented	2027-03-31	Access approval log, session recordings, quarterly access review
ENR-IMP-002 (Example)	ENR-REG-003	11 legacy HMIs that cannot be patched isolated in a dedicated segment with allow-listed flows only, replacement budgeted	Plant engineering	Partial	2027-09-30	Firewall rule review FRR-2027-02, capital plan line
ENR-IMP-003 (Example)	Annex A A.8.13 guidance	Monthly offline backup of PLC programs and relay settings, restore test twice a year	OT engineering	Implemented	2027-02-28	Backup log, restore test report (DOC-ISMS-071)
ENR-IMP-004 (Example)	ENR-REG-001	Two-factor entry at the control centre, visitor escort, CCTV with 30-day retention	Facilities	Implemented	2027-01-31	Badge logs, CCTV retention record
ENR-IMP-005 (Example)	ENR-REG-002	Intrusion alarms at 6 unattended substations linked to the control room, response within the agreed time	Field operations	Planned	2027-12-31	Alarm test records
ENR-IMP-006	[ENR-REG-nnn]	[Action]	[@owner]	[Planned / Partial / Implemented]	YYYY-MM-DD	[Record]

Status summary (Example): 6 items in this table, of which 3 are implemented, 1 partial, 1 planned and 1 blank row awaiting entries. Report the counts in the ISMS performance report (DOC-ISMS-081).

8. OT considerations and IEC 62443

8.1 Priorities

In OT the usual order of protection goals changes. Write your order and apply it to every decision in sections 4 to 7:

Safety of people and the environment.
Availability and integrity of the physical process.
Integrity of control data and settings.
Confidentiality of operational and customer information.

8.2 Engineering rules

Rule ID	Rule	Reason
OT-RULE-001 (Example)	No active vulnerability scans in Z1 or Z0 during operation; use passive monitoring and vendor advisories	Scans can crash older controllers
OT-RULE-002 (Example)	Patches installed only after vendor qualification and a test on a reference system	Unqualified patches can void safety certification
OT-RULE-003 (Example)	Emergency access ("break glass") accounts exist for control room operators and are reviewed after each use	Operators must never be locked out during an incident
OT-RULE-004 (Example)	Removable media only through a scanning kiosk in the DMZ	Removable media remain a common OT infection route
OT-RULE-005	[Rule]	[Reason]

8.3 Using IEC 62443 alongside ISO/IEC 27019

The IEC 62443 series addresses security for industrial automation and control systems (IACS). It is developed jointly by the ISA99 committee and IEC TC 65 and published by IEC (and by ISA as ANSI/ISA-62443). Use it where ISO/IEC 27019 tells you what to protect and you need technical depth on how. Commonly used parts (check current editions with the publisher):

Part	Topic	How this profile uses it
IEC 62443-2-1	Security programme for IACS asset owners	Cross-check of sections 4 to 7 with the asset owner programme
IEC 62443-2-4	Requirements for IACS service providers	Clauses in OEM and integrator contracts (DOC-ISMS-068)
IEC 62443-3-2	Risk assessment, zones and conduits	Method behind the zone model in section 3.2
IEC 62443-3-3	System security requirements and security levels	Target security level per zone
IEC 62443-4-1 and 4-2	Secure product development and component requirements	Procurement requirements for new devices

Other energy references to consider: IEC 62351 for power system communication security, IEC 63096 for nuclear facilities, and the national or regional energy frameworks listed in section 10.

9. Worked risk example

Example: Quillmere Group (2,400 staff, 6 sites in 4 countries, OT and IT) runs combined heat and power units and rooftop solar at its 3 plants. These are energy management and DER systems, which fall within the systems ISO/IEC 27019 addresses even though the group is a manufacturer, not a utility.

Field	Value
Risk ID	R-071 (Example)
Scenario	The CHP unit's OEM connects through an always-on remote access router at Plant 2. Stolen OEM credentials allow an attacker to change setpoints
Inherent likelihood x impact	4 x 5 = 20, Critical
Treatment	ENR-IMP-001 (remote access through DMZ jump host, MFA, per-session approval, recording); OT-RULE-003; OEM contract clause for credential management
Residual likelihood x impact	2 x 5 = 10, High
Acceptance	High residual risk accepted by top management with treatment in place (DOC-ISMS-019 record ACC-071 (Example))
Review	Every 6 months, or after any OEM access incident

10. Regulatory examples

Framework	Region	Relevance	Check
Directive (EU) 2022/2555 (NIS2)	EU	Energy (electricity, district heating and cooling, oil, gas, hydrogen) is a sector of high criticality; risk management measures and incident reporting	National transposition law and competent authority
Commission Delegated Regulation (EU) 2024/1366, network code on cybersecurity aspects of cross-border electricity flows	EU	Sector-specific cybersecurity rules for high-impact and critical-impact electricity entities	Consolidated text on EUR-Lex (amended 2025)
NERC CIP reliability standards	North America	Mandatory cybersecurity standards for the bulk electric system	Current versions on the NERC website
[National energy regulator rules]	[Country]	[Licence conditions, security requirements]	[Source]

11. Size tiers

Aspect	Small (under 50 people)	Medium (50 to 500)	Large or multi-site (over 500 or several sites)
Size reference	Quillmere Analytics Ltd, 46 staff (38 employees, 8 contractors), part-time ISMS manager	Quillmere Health Systems, 320 staff, full-time ISMS manager and 3-person security team	Quillmere Group, 2,400 staff, 6 sites in 4 countries, CISO and 14-person security office
Typical energy role (Example)	Analytics or software supplier handling smart meter or DER data for utilities, no own OT	Regional distribution operator, DER aggregator or charging network operator of similar size	Integrated utility, or a manufacturer with own generation and energy management at several plants
Use of ISO/IEC 27019	Selected entries on metering data, supplier duties and remote access to customer systems	Most entries, one OT zone model, OT security lead role	Full register per site, group OT security standard, IEC 62443 security levels per zone
OT governance	ISMS manager plus customer requirements	OT security lead reporting to the ISMS manager	OT security function inside the security office, site OT coordinators
Monitoring	Customer-provided or none (no OT)	Passive OT monitoring at the control centre	Passive monitoring at every site feeding a central SOC
Review cycle	Yearly	Yearly plus after major changes	Yearly per site, rolling group review

12. Records and evidence

Record	Proves	Owner	Location	Retention
OT asset inventory extract	Asset classes and zones in section 3 are current	OT engineering	[CMDB / OT asset tool]	[Current plus 3 years of snapshots]
Zone and conduit diagram with review date	Segregation design	OT network lead	[Document repository]	[Superseded versions 3 years]
Sector supplement register and SoA rows	Applicability decisions	ISMS manager	[ISMS repository]	[Life of the ISMS plus 3 years]
Remote access approvals and session recordings	ENR-IMP-001 operates	OT security lead	[Jump host logs]	[Example: 90 days recordings, 1 year approvals]
Patch qualification and change records	A.8.8 and A.8.32 in OT	OT engineering	[Change tool]	[Example: 3 years]
Backup and restore test reports	A.8.13 in OT	OT engineering	DOC-ISMS-071	[Example: 3 years]
Physical access logs for control centres and substations	A.7.2 and A.7.4	Facilities	[Access control system]	[Example: 1 year]
OT incident and exercise reports	Incident readiness in OT	OT security lead	DOC-ISMS-021, exercise folder	[Example: 6 years]

Link each record to its control in isms/control-evidence-matrix (DOC-ISMS-033).

13. References

Reference	Edition and status	Use
ISO/IEC 27019:2024, information security controls for the energy utility industry	Current (https://www.iso.org/standard/85056.html)	Sector controls and guidance
ISO/IEC 27001:2022 + Amd 1:2024	Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html)	ISMS requirements, clause 6.1.3, Annex A
ISO/IEC 27002:2022	Current (https://www.iso.org/standard/75652.html)	Control guidance the sector standard builds on
ISO/IEC 27005:2022	Current (https://www.iso.org/standard/80585.html)	Risk management guidance
IEC 62443 series	Check current editions (cited without link)	IACS security
IEC 62351 series, IEC 63096	Check current editions (cited without link)	Power system communication security, nuclear control systems
Directive (EU) 2022/2555 (NIS2)	OJ L 333, 27.12.2022 (https://eur-lex.europa.eu/eli/dir/2022/2555/oj)	Energy sector obligations in the EU
Commission Delegated Regulation (EU) 2024/1366	As amended (https://eur-lex.europa.eu/eli/reg_del/2024/1366/oj)	Electricity network code on cybersecurity
Related templates	`compliance/statement-of-applicability`, `compliance/risk-methodology`, `compliance/risk-register`, `compliance/asset-inventory`, `compliance/legal-register`, `isms/network-security-standard`, `isms/secure-configuration-baseline`, `isms/supplier-security-agreement-27036`, `isms/iot-27400-security`, `isms/backup-restore-test-log`, `isms/control-framework-crosswalk`, `isms/control-evidence-matrix`, `security/firewall-rule-review`, `industry/utility-cim-integration-design`, `compliance/nis2-security-measures`	Linked documents

Standard and licence note

Structure aligned with ISO/IEC 27019:2024 and ISO/IEC 27001:2022 + Amd 1:2024 (clause 6.1.3 and Annex A). The register, mapping, rules and examples are original. No text, control wording, tables or definitions from ISO, IEC or ISA standards are reproduced; the scope summary is a short paraphrase of the public catalogue description. You need your own licensed copy of ISO/IEC 27019 to fill section 5. Check the current editions before use, including the IEC 62443 parts. Official ISO text, purchase or licensed access: https://www.iso.org/standard/85056.html and https://www.iso.org/standard/82875.html. Regulatory summaries are short paraphrases; this is a documentation format, not legal advice.

Template licence: MIT.

Схожі шаблони

СУІБ та ISO/IEC 27001