oSIST prEN ISO/IEC 27019:2025

Information security, cybersecurity and privacy protection - Information security controls for the energy utility industry (ISO/IEC 27019:2024)

This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes.

Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Informationssicherheitsmaßnahmen für die Energieversorgung (ISO/IEC 27019:2024)

Sécurité de l'information, cybersécurité et protection de la vie privée - Mesures de sécurité de l'information pour l'industrie des opérateurs de l'énergie (ISO/IEC 27019:2024)

Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Kontrole informacijske varnosti za energetske operaterje (ISO/IEC 27019:2017, popravljena različica 2019-08)

General Information

• Status: Not Published
• Public Enquiry End Date: 03-Nov-2025
• ICS: 03.100.70 - Management systems
• ICS: 27.010 - Energy and heat transfer engineering in general
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 4020 - Public enquire (PE) (Adopted Project)
• Start Date: 21-Aug-2025
• Due Date: 08-Jan-2026
• Ref Project: prEN ISO/IEC 27019 - Information security, cybersecurity and privacy protection - Information security controls for the energy utility industry (ISO/IEC 27019:2024)

Relations

• Revises: SIST EN ISO/IEC 27019:2020 - Information technology - Security techniques - Information security controls for the energy utility industry (ISO/IEC 27019:2017, Corrected version 2019-08)
• Effective Date: 11-Jun-2025

Standards Content (Sample)

SLOVENSKI STANDARD
01-oktober-2025
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Kontrole
informacijske varnosti za energetske operaterje (ISO/IEC 27019:2017, popravljena
različica 2019-08)
Information security, cybersecurity and privacy protection - Information security controls
for the energy utility industry (ISO/IEC 27019:2024)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Informationssicherheitsmaßnahmen für die Energieversorgung (ISO/IEC 27019:2024)
Sécurité de l'information, cybersécurité et protection de la vie privée - Mesures de
sécurité de l'information pour l'industrie des opérateurs de l'énergie (ISO/IEC
27019:2024)
Ta slovenski standard je istoveten z: prEN ISO/IEC 27019
ICS:
03.100.70 Sistemi vodenja Management systems
27.010 Prenos energije in toplote na Energy and heat transfer
splošno engineering in general
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

International
Standard
ISO/IEC 27019
Second edition
Information security, cybersecurity
2024-10
and privacy protection —
Information security controls for
the energy utility industry
Sécurité de l'information, cybersécurité et protection de la vie
privée — Mesures de sécurité de l'information pour l'industrie
des opérateurs de l'énergie
Reference number
ISO/IEC 27019:2024(en) © ISO/IEC 2024

ISO/IEC 27019:2024(en)
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2024 – All rights reserved
ii
ISO/IEC 27019:2024(en)
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 2
3 Terms, definitions and abbreviated terms . 2
3.1 Terms and definitions .2
3.2 Abbreviated terms .4
4 Structure of this document . 4
5 Organizational controls . 4
5.1 Policies for information security . .4
5.2 Information security roles and responsibilities .4
5.3 Segregation of duties.4
5.4 Management responsibilities .4
5.5 Contact with authorities .5
5.6 Contact with special interest groups . .5
5.7 Threat intelligence .5
5.8 Information security in project management .5
5.9 Inventory of information and other associated assets .6
5.10 Acceptable use of information and other associated assets .6
5.11 Return of assets .6
5.12 Classification of information .6
5.13 Labelling of information .7
5.14 Information transfer .7
5.15 Access control .7
5.16 Identity management .7
5.17 Authentication information .8
5.18 Access rights .8
5.19 Information security in supplier relationships .8
5.20 Addressing information security within supplier agreements .8
5.21 Managing information security in the ICT supply chain .9
5.22 M onitoring, review and change management of supplier services .9
5.23 Information security for use of cloud services .9
5.24 Information security incident management planning and preparation .9
5.25 A ssessment and decision on information security events .9
5.26 Response to information security incidents .9
5.27 Learning from information security incidents .9
5.28 Collection of evidence . .9
5.29 Information security during disruption .9
5.30 ICT readiness for business continuity .9
5.31 L egal, statutory, regulatory and contractual requirements .10
5.32 Intellectual property rights .10
5.33 Protection of records .10
5.34 Privacy and protection of PII .10
5.35 Independent review of information security .10
5.36 C ompliance with policies, rules and standards for information security .10
5.37 Documented operating procedures .10
5.38 ENR – Identification of risks related to external business partners .10
5.39 ENR – Addressing security when dealing with customers .11
6 People controls .12
6.1 Screening . 12
6.2 Terms and conditions of employment . 12
6.3 Information security awareness, education and training . 12
6.4 Disciplinary process . 12

© ISO/IEC 2024 – All rights reserved
iii
ISO/IEC 27019:2024(en)
6.5 Responsibilities after termination or change of employment. 12
6.6 Confidentiality or non-disclosure agreements . 12
6.7 Remote working . 13
6.8 Information security event reporting. 13
7 Physical controls .13
7.1 Physical security perimeters . 13
7.2 Physical entry . 13
7.3 Securing offices, rooms and facilities . 13
7.4 Physical security monitoring . . 13
7.5 Protecting against physical and environmental threats .14
7.6 Working in secure areas .14
7.7 Clear desk and clear screen .
...