Overview

ISO/IEC 27019:2017 - Information technology - Security techniques - Information security controls for the energy utility industry - provides sector-specific guidance for applying ISO/IEC 27002:2013 controls to process control systems in the energy utility sector. It addresses information security for systems that control and monitor generation, transmission, storage and distribution of electric power, gas, oil and heat, including associated supporting systems, software, firmware, premises and remote maintenance. The standard adapts ISO/IEC 27001:2013 risk assessment and treatment processes for energy-industry operational technology (OT) environments. ISO/IEC 27019 does not cover nuclear process control (see IEC 62645).

Key topics and technical requirements

ISO/IEC 27019 tailors general information security controls to the unique needs of energy utilities and OT. Major technical topics include:

Asset management for OT: inventories and ownership of controllers, PLCs, smart meters (AMI), DMS/OMS applications, historians and telemetry devices.
Access control and privileged access: management of operator accounts, segregation of duties, secure log-on and privileged utility program controls.
Network and communication security: protection of control networks, telemetry/telecontrol links, SCADA/RTU communications and remote control channels.
Physical and environmental security: secure areas for control centres, equipment rooms, peripheral sites and premises hosting energy equipment.
Operations security and change management: documented procedures, separation of development/test/production, malware protection, backups, and secure software installation on operational systems.
Logging, monitoring and incident readiness: event logging, log protection, administrator/operator logs, clock synchronization and incident response alignment with OT processes.
Cryptography and key management: policies for cryptographic controls suitable for energy-sector devices and communications.
Technical vulnerability and lifecycle management: vulnerability assessment, patching considerations for safety-critical devices, secure disposal and firmware management.
Energy-sector-specific controls (ENR): guidance for securing control centres, peripheral sites, customer-premise equipment, DER and distributed smart-grid components.

Practical applications and who uses it

ISO/IEC 27019 is intended for organizations operating or supporting energy utility process control systems, including:

Utilities (generation, transmission and distribution)
OT and SCADA engineers, control system integrators and system architects
CISOs, security managers and compliance officers focused on energy utility cybersecurity
Vendors of PLCs, RTUs, AMI/smart meters, DMS/OMS and energy-management systems
Auditors and regulators assessing OT security controls and risk treatment

Use cases include developing OT security policies, aligning ISO/IEC 27001 ISMS with process-control risks, securing smart grid and DER deployments, and hardening remote maintenance and AMI infrastructures.

Related standards

ISO/IEC 27002:2013 - Code of practice for information security controls (base guidance)
ISO/IEC 27001:2013 - Information security management systems (risk assessment/treatment requirements)
IEC 62645 - Security for nuclear facility process control (nuclear-specific domain)

Keywords: ISO/IEC 27019, energy utility cybersecurity, process control systems, OT security, smart grid security, AMI security, PLC security, ISO/IEC 27002, ISO/IEC 27001.

Overview

Key topics and technical requirements

ISO/IEC 27019 tailors general information security controls to the unique needs of energy utilities and OT. Major technical topics include:

Asset management for OT: inventories and ownership of controllers, PLCs, smart meters (AMI), DMS/OMS applications, historians and telemetry devices.
Access control and privileged access: management of operator accounts, segregation of duties, secure log-on and privileged utility program controls.
Network and communication security: protection of control networks, telemetry/telecontrol links, SCADA/RTU communications and remote control channels.
Physical and environmental security: secure areas for control centres, equipment rooms, peripheral sites and premises hosting energy equipment.
Operations security and change management: documented procedures, separation of development/test/production, malware protection, backups, and secure software installation on operational systems.
Logging, monitoring and incident readiness: event logging, log protection, administrator/operator logs, clock synchronization and incident response alignment with OT processes.
Cryptography and key management: policies for cryptographic controls suitable for energy-sector devices and communications.
Technical vulnerability and lifecycle management: vulnerability assessment, patching considerations for safety-critical devices, secure disposal and firmware management.
Energy-sector-specific controls (ENR): guidance for securing control centres, peripheral sites, customer-premise equipment, DER and distributed smart-grid components.

Practical applications and who uses it

ISO/IEC 27019 is intended for organizations operating or supporting energy utility process control systems, including:

Utilities (generation, transmission and distribution)
OT and SCADA engineers, control system integrators and system architects
CISOs, security managers and compliance officers focused on energy utility cybersecurity
Vendors of PLCs, RTUs, AMI/smart meters, DMS/OMS and energy-management systems
Auditors and regulators assessing OT security controls and risk treatment

Related standards

ISO/IEC 27002:2013 - Code of practice for information security controls (base guidance)
ISO/IEC 27001:2013 - Information security management systems (risk assessment/treatment requirements)
IEC 62645 - Security for nuclear facility process control (nuclear-specific domain)

Keywords: ISO/IEC 27019, energy utility cybersecurity, process control systems, OT security, smart grid security, AMI security, PLC security, ISO/IEC 27002, ISO/IEC 27001.

ISO/IEC 27019:2017 PDF

Technical details

Abstract

Overview

Key topics and technical requirements

Practical applications and who uses it

Related standards

Related standards

Abstract

Overview

Key topics and technical requirements

Practical applications and who uses it

Related standards

Related standards

Information technology — Security techniques — Code of practice for information security controls

Information technology — Security techniques — Information security management systems — Requirements

Information security, cybersecurity and privacy protection - Information security controls for the energy uti…

Corrigendum 1 - Nuclear power plants - Instrumentation and control systems - Requirements for security progra…

Information security, cybersecurity and privacy protection - Information security management systems - Requir…

Health informatics - Information security controls in health based on ISO/IEC 27002 (ISO 27799:2025)