13.1 Supporting utilities

Requirement

For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities shall prevent loss, damage or compromise of network and information systems or interruption to their operations due to the failure and disruption of supporting utilities.

Guidance

• Consider supporting utilities, where relevant (107), that ensure the continuous operation of network and information systems, such as (indicative, non-exhaustive list):
  • power supply – electricity to keep systems running;
  • water for cooling and other operational needs;
  • gas for heating or backup power generation;
  • HVAC to maintain optimal operating conditions;
  • telecommunications – internet and network connectivity.
• Include the potential failure and disruption of supporting utilities in the risk assessment.

Examples of evidence

• List of supporting utilities and associated risk assessment results.
• Measures to protect against the failure and disruption of supporting utilities.

Requirement

For that purpose, the relevant entities shall, where appropriate: (a) protect facilities from power failures and other disruptions caused by failures in supporting utilities such as electricity, telecommunications, water supply, gas, sewage, ventilation and air conditioning; (b) consider the use of redundancy in utilities services; (c) protect utility services for electricity and telecommunications, which transport data or supply network and information systems, against interception and damage; (d) monitor the utility services referred to in point (c) and report to the competent internal or external personnel events outside the minimum and maximum control thresholds referred to in point 13.2.2(b) affecting the utility services; (e) conclude contracts for the emergency supply with corresponding services, such as for the fuel for emergency power supply; (f) ensure continuous effectiveness, monitor, maintain and test the supply of the network and information systems necessary for the operation of the service offered, in particular the electricity, temperature and humidity control, telecommunications and Internet connection.

Guidance

• Consider the availability of supporting utilities in the business continuity plan (section 4.1) .
• Consider the availability of supporting utilities, when implementing backup management (section 4.2).
• Consider implementing measures for the protection of supporting utilities, such as (indicative, non-exhaustive list):
  • active/passive cooling;
  • automatic restart after power interruption;
  • battery backup power;
  • diesel generators;
  • backup fuel;
  • uninterruptable power supply, hot standby power generators;
  • sufficient fuel delivery SLA;
  • delivery companies;
  • redundant cooling;
  • spare parts for components of network and information systems; and
  • power backup systems.

Examples of evidence

• Description of different types of supporting utilities.
• Measures to protect against the failure and disruption of supporting utilities.

Requirement

The relevant entities shall test, review and, where appropriate, update the protection measures on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Conduct routine tests of protection measures.
• Set up periodic reviews to evaluate the effectiveness of current protection measures.

Examples of evidence

• Updated measures to protect against the failure and disruption of supporting utilities, review comments and/or change logs.
• Evidence that the measures that protect supporting utilities against failures and disruptions are deployed and regularly tested.

Tips: guidance

• Include a simulated total power failure in the verification of the testing procedure for power generators.
• Make employees aware of dependencies on supporting utilities.
• Train staff in how to respond effectively to failures and disruptions of supporting utilities.
• Set up monitoring systems to detect utility failures or disruptions.

Tips: examples of evidence

• Records of internal communications, emails or newsletters highlighting the importance of supporting utilities and their impact on operations.
• Logs demonstrating detection and recording of any utility failures or disruptions.