A standard ISO/IEC 27001 information security management system was designed around offices and data centres, not substations, control centres, telecontrol links and smart meters. ISO/IEC 27019 closes that gap: it provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for the systems that control and monitor the generation, transmission, storage and distribution of electricity, gas, oil and heat. The second edition was published on 18 October 2024, and in Germany its use becomes mandatory in the Bundesnetzagentur IT security catalogues from October 2026. This guide explains scope, how 27019 fits into an ISMS, the German regulatory mandate, identity and machine credential issues in energy control systems, an implementation plan, certification evidence and mapping to other frameworks. It is for ISMS managers, OT security leads and auditors at grid operators, generators, storage operators and their service providers.
Key takeaways
- It is sector guidance on top of ISO/IEC 27002: 27019:2024 is not a separate management system standard; you certify against ISO/IEC 27001 and use 27019 to select and implement controls for energy process control systems.
- The 2017 edition is withdrawn: ISO withdrew ISO/IEC 27019:2017 on 18 October 2024, the day edition 2 was published, so Statements of Applicability that cite the old structure need updating.
- Germany makes it binding: the Bundesnetzagentur catalogues under the Energy Industry Act (EnWG) require an ISO/IEC 27001 certified ISMS that takes 27002 and 27019 into account, and require the updated 27019 from October 2026.
- Scope is wide: it covers control systems, PLCs and field devices, telecontrol communications, smart metering, protection and safety systems, energy management, premises and remote maintenance, but not nuclear process control.
- Remote maintenance and machine credentials are where incidents start: vendor access paths, shared engineering accounts and service accounts linking IT to control systems need explicit ownership and control.
What it is and who it applies to
ISO/IEC 27019:2024, "Information security, cybersecurity and privacy protection: Information security controls for the energy utility industry", is published by ISO/IEC JTC 1/SC 27 and runs to 39 pages. It replaced ISO/IEC 27019:2017, which itself succeeded the 2013 technical report ISO/IEC TR 27019. Like ISO/IEC 27017 for cloud or 27701 for privacy, it extends the generic control set of ISO 27002 Controls Guide with sector-specific implementation guidance and additional controls.
Systems in scope (from the ISO abstract)
| Scope item | Typical examples in a utility |
|---|---|
| Central and distributed process control, monitoring and automation | SCADA and energy management systems in control centres, distributed control systems in plants |
| Digital controllers, PLCs and field devices | Protection relays, remote terminal units, bay controllers |
| Supporting information systems | Historians, visualisation, reporting and archiving |
| Communication technology | Telecontrol links, wide area networks, radio and telemetry |
| Advanced Metering Infrastructure | Smart meters and head-end systems; see the Smart Meter Security Guide |
| Measurement, protection and safety systems | Safety instrumented systems, metering at transformer stations |
| Smart grid components and distribution software | Distribution and outage management systems, distributed energy resource controllers |
| Software, firmware and premises | Engineering software, firmware images, control rooms, substations and remote sites |
| Remote maintenance systems | Vendor and integrator remote access to the above |
The standard does not apply to the process control domain of nuclear facilities, which ISO points to IEC 63096. It applies to any organisation operating these systems, whether a transmission or distribution system operator, a generator, a storage operator, a gas network or a district heating company, and to service providers who operate them under contract.
Structure and key requirements
Edition 2 follows the structure of ISO/IEC 27002:2022, which groups 93 controls into four themes: organisational, people, physical and technological. For each control, 27019 either confirms that the 27002 guidance applies, adds energy-specific implementation guidance, or adds controls that have no 27002 equivalent. ISO's public abstract does not list the additional controls, and NHI Mgmt Group has not reproduced the paid text, so obtain the standard itself before writing your Statement of Applicability. The table below shows where energy guidance typically changes how a 27002 control is implemented, based on the scope above.
| ISO/IEC 27002:2022 control area | Why energy systems differ | Practical implementation |
|---|---|---|
| 5.19 to 5.22 Supplier relationships | Vendors and integrators often operate or maintain control systems | Contractual security duties, the operator keeps overall responsibility (as the German catalogues state explicitly) |
| 5.15 to 5.18 Access control, identity, authentication | Shared engineering and operator accounts, devices with fixed passwords | Named accounts where the device supports it, compensating controls where it does not, access via a controlled jump host |
| 7.1 to 7.4 Physical perimeters and monitoring | Unmanned substations and remote sites, shared premises with other utilities | Site security tiers, intrusion detection on remote sites, controlled shared areas |
| 8.8 Technical vulnerabilities | Long lifetimes, patching needs outage windows and vendor approval | Risk based patching, virtual patching, vendor qualification of updates |
| 8.20 to 8.22 Network security and segregation | Telecontrol protocols, legacy serial links, IT to OT interfaces | Zones and conduits, protocol aware filtering, secured telecontrol (see the IEC 62351 Power System Communications Security Guide) |
| 8.13, 8.14 Backup and redundancy | Availability outranks confidentiality; black start capability | Offline configuration backups for relays and controllers, tested restoration |
| 8.15, 8.16 Logging and monitoring | Field devices with limited logging | Network monitoring and attack detection systems at control centre and substation boundaries |
| 5.24 to 5.28 Incident management | Physical safety and supply consequences | Joint IT and OT playbooks, coordination with grid operations and the regulator |
The German mandate
Germany is where ISO/IEC 27019 is a legal requirement in practice. The Bundesnetzagentur (BNetzA) IT security catalogues set the rules:
| Catalogue | Who | Key requirements | Original deadlines |
|---|---|---|---|
| Grid catalogue, August 2015 (section 11(1a) EnWG, old version) | Electricity and gas grid operators | ISMS per ISO/IEC 27001 covering systems needed for safe grid operation; consider 27002 and 27019 according to risk; network structure plan in three technology categories (control systems and system operation, transmission and communication, secondary, automation and telecontrol); damage categories critical, high, moderate with "high" as the default; named IT security contact | Contact by 30 November 2015; certification proof by 31 January 2018 |
| Energy plant catalogue, December 2018 (section 11(1b) EnWG, old version) | Operators of energy plants classed as critical infrastructure (KRITIS) | Systems assigned to zones 1 to 6 by failure tolerance; ISMS covering at least zones 1 to 3; no risk acceptance in zone 1; at most medium residual risk; certification by a DAkkS accredited body | Contact by 28 February 2019; certification proof by 31 March 2021 |
| Digital energy services catalogue | Operators of digital energy services | In preparation; BNetzA planned consultation for autumn 2026 | Not yet set |
As of BNetzA's page dated 10 August 2026, the NIS2 implementation law took effect on 6 December 2025 and moved the IT security provisions to sections 5c to 5e EnWG. The existing catalogues continue to apply until new ones are published, both catalogues are being revised for NIS2, and the updated ISO/IEC 27019 becomes mandatory in the catalogues from October 2026. A mapping table from the old 27019 structure to ISO/IEC 27002:2022 remains available until then. Check BNetzA directly before each audit cycle; see also the Germany NIS2 Implementation Guide.
Identity and NHI requirements
Energy control systems contain more machine identities than human ones: protocol gateways, historian collectors, SCADA service accounts, engineering workstation accounts, meter head-end certificates and vendor remote access credentials. Applying 27002 access controls (5.15 to 5.18, 8.2 Privileged access rights, 8.5 Secure authentication) in this environment means:
- Remote maintenance access: 27019 explicitly includes remote maintenance systems in scope. Every vendor path should terminate at a monitored jump host with individual accounts, MFA and session recording, and be enabled per job. The Colonial Pipeline attack began with a legacy VPN account that was never disabled and had no MFA; the operational shutdown followed from an IT compromise.
- Shared engineering accounts: many relays and PLCs support only one or a few local accounts. Store those credentials in a vault, check them out per task, rotate after vendor visits and log every use.
- IT to OT service accounts: historian replication, patch distribution and backup jobs often use domain service accounts with rights in both networks. Give each a single purpose, restrict it to the conduit it needs and alert on interactive use. See the Energy Sector Identity and OT Access Guide.
- Device certificates: smart meters, secured telecontrol and substation automation increasingly rely on certificates. Treat the issuing PKI as part of the ISMS scope, with certificate inventory and expiry monitoring.
- Automation and AI tools: scripts and analytics platforms that read from or write to control systems hold credentials too. Inventory them like any other non-human identity; the Identity for OT Environments Guide covers patterns.
Implementation steps
- Buy and read the current edition: obtain ISO/IEC 27019:2024 and, if you are German, the applicable BNetzA catalogue and mapping documents.
- Define ISMS scope around operations: list systems needed for safe grid or plant operation. German grid operators build a network structure plan in the three technology categories; plant operators assign systems to zones 1 to 6. Mark interfaces to out-of-scope or outsourced systems clearly.
- Run the risk assessment with energy impact criteria: include security of supply, affected population, danger to life, effects on other infrastructure, data protection and financial impact, and treat both deliberate and accidental threats. In German catalogues "high" is the default for necessary systems and lower ratings need documented justification.
- Update the Statement of Applicability: move from the 2013 Annex A structure to the 2022 structure, adding 27019 controls and guidance. The BNetzA explanation document asks operators to check existing controls against new ones in risk treatment (ISO/IEC 27001 clause 6.1.3 c) and revise the SoA (clause 6.1.3 d). See the ISO 27001 Statement of Applicability Template.
- Prioritise boundary and access controls: segment control networks, secure remote maintenance, vault shared credentials and deploy attack detection at boundaries. In Germany, operators must keep attack detection systems running under section 11(1e) EnWG (old version).
- Bring suppliers in: contractually require operators and maintainers of in-scope systems to meet the controls; under the catalogues the operator keeps overall responsibility.
- Pilot changes safely: test new controls (patches, agents, filtering rules) on a reference system or test bay before production, schedule changes in outage windows and keep tested rollback configurations for every controller you touch.
- Certify and maintain: have an accredited certification body audit the ISMS, then run annual surveillance audits and recertification within the three-year cycle.
Small utility or large operator
A municipal utility with a small team usually outsources control system operation and should focus on supplier contracts, remote access control and a lean but complete network structure plan; sharing a certified ISMS service with other municipal utilities is common. A transmission operator or large generator needs a dedicated OT security function, in-house attack detection, its own credential vaulting for field devices and a formal link between the ISMS and grid operations change control.
Evidence and assessment
| Evidence | What the auditor checks | Metric to track |
|---|---|---|
| Scope statement and network structure plan or zone assignment | All systems needed for safe operation are included, interfaces marked | Percentage of OT assets in the asset inventory mapped to a zone or category |
| Risk assessment with energy damage categories | Criteria include supply and safety, downgrades justified | Number of systems rated below "high" without documented justification (target zero) |
| Statement of Applicability in the 2022 structure with 27019 additions | Every 27019 control addressed, exclusions justified | Open SoA gaps and their target dates |
| Remote access records | Individual accounts, MFA, per-job enablement, session logs | Percentage of vendor sessions recorded; dormant remote accounts older than 90 days (target zero) |
| Credential vault reports | Shared device credentials stored, checked out and rotated | Percentage of field device credentials vaulted; rotation after vendor visits |
| Attack detection and incident records | Monitoring at boundaries, reports to the regulator or CSIRT where required | Mean time to detect boundary anomalies in exercises |
Mapping to other frameworks
| Topic | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 | IEC 62443 and sector frameworks |
|---|---|---|---|
| Segmentation of control networks | A.8.20, A.8.22 | PR.IR-01 | IEC 62443-3-2 zones and conduits; OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide |
| Access and privileged access | A.5.15, A.8.2, A.8.5 | PR.AA-05 | NERC CIP Guide: CIP-004 and CIP-005 in North America |
| Supplier security | A.5.19 to A.5.22 | GV.SC-05 | IEC 62443-2-4 service provider requirements |
| Monitoring and attack detection | A.8.15, A.8.16 | DE.CM-01 | German attack detection obligation, section 11(1e) EnWG old version |
| Vulnerability management | A.8.8 | ID.RA-01 | NIST SP 800-82 OT Security Guide |
| Communications security | A.8.21 | PR.DS | IEC 62351 for power system protocols |
For utilities outside Germany, 27019 is a strong way to show NIS2 risk management measures for the energy sector within an existing ISO 27001 programme; see the NIS2 Directive Guide and the Electric Utility Cybersecurity Programme Guide.
Common pitfalls
- Scoping only the control centre: substations, telecontrol links, metering and remote maintenance are in 27019 scope, and auditors look for them in the structure plan.
- Still citing the 2017 edition: the old edition is withdrawn and the German catalogues require the 2024 edition from October 2026.
- Copying IT controls unchanged: the catalogues say 27002 and 27019 measures should not be applied unchecked but according to their importance for safe operation. Aggressive scanning or automatic patching can cause outages.
- Forgotten remote and service accounts: dormant vendor VPN accounts and IT to OT service accounts are the most common entry route; review them every quarter.
- Outsourcing the responsibility along with the work: the operator remains responsible when a service provider runs the systems.
- Downgrading risk ratings without justification: in Germany, rating a necessary system "moderate" needs detailed documented reasoning.
Practitioner checklist
- Obtain ISO/IEC 27019:2024 and retire references to the 2017 edition.
- Document ISMS scope with all systems needed for safe operation, including remote sites and metering.
- Build or refresh the network structure plan or zone assignment.
- Run the risk assessment with security of supply and safety criteria.
- Rebuild the Statement of Applicability in the 2022 structure with 27019 additions.
- Put all remote maintenance behind individual, MFA protected, recorded access.
- Vault shared field device credentials and inventory IT to OT service accounts.
- Deploy and test attack detection at control network boundaries.
- Write security duties into every supplier contract for in-scope systems.
- German operators: confirm current BNetzA catalogue status before each audit cycle.
Standards and references
- ISO: ISO/IEC 27019:2024 Information security controls for the energy utility industry
- ISO: ISO/IEC 27019:2017 (withdrawn)
- Bundesnetzagentur: IT-Sicherheit im Energiesektor
- Bundesnetzagentur: IT-Sicherheitskatalog gemäß § 11 Absatz 1a EnWG
- Bundesnetzagentur: IT-Sicherheitskatalog gemäß § 11 Absatz 1b EnWG
- Bundesnetzagentur: Erläuterungsdokument zur Mapping-Tabelle ISO/IEC 27002:2022
Related NHI Mgmt Group resources: Smart Grid Security Guide · ISO 27001 Certification Guide · Energy Sector Identity and OT Access Guide · IEC 62351 Power System Communications Security Guide. This guide summarises ISO/IEC 27019 and the German BNetzA IT security catalogues as published at 27 October 2026 and is not legal advice.