Most security programmes assume electricity, mobile networks and fuel will be there, and very few have tested what their controls, people and identity systems do when all three fail at once. On 28 April 2025 continental Spain and Portugal lost power entirely, and within hours mobile networks, rail, flights and emergency calling were degraded across the peninsula. This guide treats power and its knock-on dependencies as a security problem: which controls fail open or closed, how long your UPS, generator and carrier backup really last, how the security team keeps detecting and deciding during a long outage, and how to recover safely. It is for security leaders, physical security and facilities managers, SOC leads and continuity planners. Data centre facility engineering is covered separately in the Data Centre Security Guide; this guide is about the organisation that depends on power, not the building that supplies it.
Key takeaways
- Power failure is a cascading, multi-dependency event. Telecoms, transport, payments and supplier services fail on their own battery and fuel timelines, so plan for a sequence of failures over hours, not a single switch-off.
- Know which security controls fail open and which fail closed. Door locks, turnstiles, CCTV, alarm panels, badge servers and network security appliances each behave differently on power loss, and the default is rarely what you would choose.
- Your backup runtime is set by the weakest dependency. A 48 hour generator does not help if the mobile network serving your out-of-band channel has a four hour battery.
- Identity and authentication need an offline plan. Cloud MFA, push approvals and SMS codes depend on networks that are among the first things to degrade.
- Recovery is a security risk window. Mass restarts, bypassed controls and rushed reconnections create the conditions attackers and errors exploit; restore in a planned order and verify.
What the Iberian blackout showed
ENTSO-E, the European network of transmission system operators, records the blackout as starting at 12:33 CEST on 28 April 2025, with a total loss of supply in continental Spain and Portugal and brief disruption in a small area of south-west France. Its expert panel published a factual report on 3 October 2025 and a final report on 20 March 2026, attributing the event to many interacting factors: oscillations, gaps in voltage and reactive power control, differing voltage regulation practices, rapid output reductions and generator disconnections in Spain, which led to fast overvoltage and cascading generation loss. Portugal's regulator ERSE noted that the Portuguese transmission network was fully restored at around 23:20 using hydro and gas plants with black start capability, and ENTSO-E classified the event at the most serious level on its incident scale.
The cause was in the grid. The security lessons are in what happened next.
| Dependency | What was reported | Lesson for security teams |
|---|---|---|
| Mobile networks | A GSMA analysis of Portugal found more than one in three mobile users had no service at the evening peak; one operator's no-service share rose above 90 percent within four hours, while the most resilient peaked at just over 16 percent. Sites with no backup went dark immediately and sites with four hour batteries dropped when they expired. | Out-of-band communications, SMS MFA and mobile alarm signalling inherit your carrier's battery depth, which differs sharply between carriers |
| Emergency calling | Portugal's telecoms regulator ANACOM reported that access to 112 was heavily restricted on fixed networks and stayed available only where at least one mobile network was working | Fixed lines in offices may not reach emergency services; plan alternative ways to call for help from sites |
| Transport | Portugal's aviation regulator reported 348 cancelled flights at Lisbon, 60 at Porto and 29 at Faro; the transport regulator reported 93 trains and metro units immobilised by loss of traction power | Staff may not reach sites, and on-call engineers may be stranded; plan for who is physically able to respond |
| Recovery priorities | ANACOM recommended minimum runtimes for network elements, a priority list for power restoration, fuel access for telecoms firms, satellite redundancy, Cell Broadcast alerts and joint exercises | The same list applies to your organisation: minimum runtimes, fuel, alternate channels and exercises |
Map your power dependency chain
Start by tracing each critical service back to the power and telecoms it needs, including services you buy. CISA's Infrastructure Resilience Planning Framework asks planners to account for the impacts of dependencies and cascading disruptions; for a security team that means asking, for each control, "what does this need to keep working, and for how long does it have it?"
- List critical security functions: physical access control, intruder alarms, CCTV, the SOC and its tooling, identity provider and MFA, privileged access, incident communications, key management and backups.
- For each, record its power source and runtime: mains, UPS (minutes), generator (hours, set by fuel), cloud provider (outside your control), or battery in the device itself.
- Record its communications path: fixed broadband, mobile, radio, satellite, and which carrier.
- Record people dependencies: who must be on site, how they get there and how you reach them.
- Find the shortest runtime in each chain: that is the real runtime of the function.
- Repeat for key suppliers: managed SOC, alarm receiving centre, cloud regions, payment processors and guarding companies. Ask them the same questions and record their answers.
NIST CSF 2.0 frames this as knowing and prioritising suppliers by criticality (GV.SC-04) and maintaining inventories of supplier services (ID.AM-04). The Business Continuity and Disaster Recovery Guide covers the business impact analysis this feeds.
Fail open or fail closed: security controls on power loss
Every powered security control has a failure state. Decide it deliberately, document it and check it on site, because installer defaults vary.
| Control | Typical behaviour on power loss | Decision to make | Backup to specify |
|---|---|---|---|
| Electromagnetic door locks (mag locks) | Release (fail safe) when power is removed | Life safety usually requires fail safe on escape routes; perimeter and secure rooms need another layer such as a mechanical lock | Dedicated lock power supply with battery; mechanical override keys under key control |
| Electric strikes | Configurable as fail safe or fail secure | Fail secure for server rooms and stores where escape is not through that door, subject to fire safety rules | Battery in the access control panel; documented key override |
| Access control servers and panels | Panels may keep local card decisions while on battery; central server and logging stop | Which doors keep working offline and for how long | Panel batteries sized to target runtime; server on UPS and generator |
| Intruder alarms | Panel battery keeps detection running for a limited period; signalling depends on the path | Whether the alarm receiving centre will still hear you | Dual-path signalling on different carriers or technologies; confirm panel battery standby time |
| CCTV and recorders | Cameras on PoE switches go dark when the switch loses power | Which cameras matter during an outage (entrances, server rooms) | UPS on recorders and the switches feeding priority cameras |
| Firewalls and network security appliances | Stop passing traffic; some bypass modules fail open | Whether a hardware bypass is acceptable on restore | UPS with orderly shutdown; review bypass settings |
| Endpoints and laptops | Run on battery for hours, then need charging | Which roles need charged devices and power banks | Charging at generator-backed points |
Life safety rules for escape routes take priority over security preferences; agree fail-safe and fail-secure choices with fire safety advisers. See the Physical Security Guide for Security Teams for the wider controls.
UPS, generators and runtime
NIST SP 800-53 Rev. 5 separates three layers. PE-11 requires an uninterruptible power supply to allow an orderly shutdown or transition to long-term alternate power, PE-11(1) requires an alternate power supply that maintains minimally required operational capability during an extended loss, and PE-11(2) requires that supply to be self-contained and not reliant on external power generation. PE-9 covers protecting power equipment and cabling. ISO/IEC 27001:2022 Annex A control 7.11, supporting utilities, covers the same ground.
| Layer | Purpose | Typical runtime | Common gaps |
|---|---|---|---|
| UPS | Ride through short dips and bridge to generator start, or allow orderly shutdown | Minutes | Batteries never load tested; UPS covers servers but not the switches, door panels or alarm signalling they depend on |
| Standby generator with transfer switch | Carry critical loads for an extended outage | Hours to days, set by fuel on site | Transfer switch untested; generator sized for IT but not cooling; fuel contract assumes deliveries will arrive |
| Self-contained supply (PE-11(2)) | Run without any external generation, for example on-site storage or renewables | Depends on storage and generation | Rarely sized for security loads |
| Device batteries | Keep panels, phones and radios alive | Hours | Batteries aged or missing; no charging plan |
- Fuel is a supply chain: a long regional outage affects the fuel suppliers and the roads. ANACOM and Portugal's transport regulator both recommended priority fuel access and refuelling protocols. Hold enough fuel on site for your target runtime and know your supplier's own power plan.
- Test under load: run generators under real load on a schedule and test the transfer switch, not just the engine. Record results.
- Size for what you actually need: include cooling, network switches, door panels, alarm signalling and lighting for staff, not just servers.
Communications and the security team during an outage
NIST SP 800-53 CP-8 requires alternate telecommunications services for essential functions, and CP-8(2) requires that they do not share a single point of failure with the primary. The Iberian data shows why the carrier and its backup depth matter as much as having a second line.
- Two carriers, two technologies: pair fixed fibre with mobile from a different operator, and add satellite or radio for the crisis team.
- Ask carriers about site backup: request their battery and generator policy for the cells and exchanges serving your key sites. Answers differ widely.
- Printed contact trees and rally points: if phones fail, staff need to know where to go and when. Agree check-in times in advance.
- Keep the SOC seeing: if the SOC is on site, its screens, network and log collection need generator power; if it is a managed service, confirm the provider's own resilience and how you will reach them.
- Alerts and public warnings: ANACOM recommended Cell Broadcast for public alerts; internally, plan how you will warn staff when email and chat are down.
See the Crisis Management Guide for decision-making structures.
Where identity fits
Identity is often the hidden casualty of a long outage. Push MFA and SMS codes need mobile networks; cloud identity providers may be reachable only over a degraded link; on-premises domain controllers need power and cooling. Plan an emergency access path in advance: break-glass accounts protected by hardware security keys that work without a network round trip on the user side, stored and logged under dual control, and documented procedures for using them. Service accounts and scheduled jobs restarting after power returns will authenticate in bulk, so expect alert spikes and make sure lockout policies do not trip critical automation. See the Emergency Identity Operations When the Primary IdP Is Unavailable guide and the Break-Glass Emergency Access Guide.
Recovery: restoring safely
When power returns, organisations rush. That is when doors are propped, controls bypassed and systems reconnected unchecked.
- Restore in priority order: life safety, then security monitoring (alarms, CCTV, access control), then identity and network, then business systems. Write the order down before you need it.
- Stage loads: bring large loads back in steps so generators and transfer switches are not overloaded and power quality is stable.
- Check control states: confirm doors that failed safe are locked again, alarm panels are armed and signalling, and any network bypass is closed.
- Verify logs and clocks: devices that lost power may have wrong time, which breaks log correlation and some authentication; check time sync before trusting logs.
- Review what happened while blind: check access logs, CCTV gaps and badge use during the outage for anything unexpected.
- Stand down deliberately: return break-glass credentials, rotate any that were used and record the timeline for lessons learned.
Decision guidance: what to invest in
| Organisation | Priority investments | What can wait |
|---|---|---|
| Small office, cloud-first | Fail-secure decisions on doors, dual-path alarm signalling, charged laptops and power banks, printed contacts, hardware keys for admin accounts | On-site generator |
| Mid-size, several sites | UPS for network and security systems at each site, carrier diversity, a crisis team satellite or radio option, written restore order | Self-contained supply |
| Large or critical entity | Generator with on-site fuel for target runtime, tested transfer switches, supplier assurance on power, regular blackout exercises, self-contained supply for the most critical loads | Little: regulators increasingly expect this. See the EU Critical Entities Resilience Directive Guide. |
Detection and measurement
- Monitor the backup itself: UPS state, battery health, generator run status, fuel level and transfer switch position should alert the facilities and security teams.
- Track power events on security devices: alarm panel mains-fail and low-battery signals, access control panel offline events and camera loss.
- Metrics:
- Shortest end-to-end runtime of each critical security function against target.
- Percentage of UPS and generators load tested in the last 12 months.
- Percentage of critical suppliers that have answered power resilience questions.
- Number of security controls with a documented and verified failure state.
- Time to restore security monitoring after power returns in the last exercise.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| UPS and alternate power | PE-11, PE-11(1), PE-11(2) | PR.IR-03, PR.IR-04 | 7.11 Supporting utilities |
| Power equipment and cabling | PE-9 | PR.IR-03 | 7.12 Cabling security |
| Alternate communications | CP-8, CP-8(2) | PR.IR-03 | 5.30 ICT readiness for business continuity |
| Contingency planning and testing | CP-2, CP-2(8), CP-4 | RC.RP-01 | 5.29, 5.30 |
| Recovery | CP-10 | RC.RP-01 | 5.30 |
| Supplier dependencies | SA-9 | GV.SC-04, ID.AM-04 | 5.21 Managing information security in the ICT supply chain |
Common failure patterns
- UPS on the servers, not the switches: servers stay up but nothing can reach them because the network gear in the same room has no backup.
- Doors fail safe everywhere: mag locks on the perimeter and secure rooms release, and no one has a plan to secure the site manually.
- Alarm signalling on one path: the panel keeps detecting on battery, but its only signalling path is a mobile network that drops after a few hours.
- Generator never tested on load: the engine starts in monthly tests but the transfer switch fails when it is needed.
- MFA that needs the network: administrators cannot sign in to manage the incident because every factor depends on mobile or internet access.
- Single carrier "diversity": two lines from the same operator, sharing the same cell site or exchange backup.
Practitioner checklist
- Map each critical security function to its power source, runtime, communications path and people.
- Document and verify the power-loss failure state of every door, alarm, camera and network security device.
- Put network switches, door panels and alarm signalling on UPS alongside servers.
- Load test generators and transfer switches on a schedule and record results.
- Hold fuel for your target runtime and confirm your fuel supplier's own plan.
- Use alternate communications from a different carrier and technology, plus satellite or radio for the crisis team.
- Provide offline-capable break-glass access protected by hardware security keys.
- Write and exercise a restore order that puts security monitoring before business systems.
- Ask critical suppliers about their power resilience and record the answers.
- Run a full blackout exercise at least yearly that includes loss of mobile networks.
Standards and references
- ENTSO-E: 28 April 2025 Blackout
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- CISA: Infrastructure Resilience Planning Framework
- Government of Portugal: ANAC, ANACOM and IMT reports on the blackout
- ERSE: Investigation into the Iberian blackout of 28 April 2025
- GSMA: How Portugal's mobile networks handled the Iberian Peninsula blackout
Related NHI Mgmt Group resources: Data Centre Security Guide · Business Continuity and Disaster Recovery Guide · Physical Security Guide for Security Teams · Crisis Management Guide