Key takeaways
- A note on sourcing: this guide's research fetch of ISO.org's own catalogue page for ISO/IEC 27019 did not return page content (an access error rather than rendered text).
- ISO/IEC 27019 is not a standalone ISMS standard — it is a sector-specific supplement.
- IEC 62443 — cross-sector industrial automation and control systems security: organizational programs, system requirements and component requirements, applicable to any OT sector, not just energy.
- Confirm which edition a contract or auditor expects.
ISO/IEC 27019, "Information security controls for the energy utility industry," takes the generic ISO/IEC 27002 control catalogue and adapts it for the part of an energy utility's environment that generic IT security guidance tends to fit badly: process control and automation systems controlling the generation, transmission, storage and distribution of electric power, gas, oil and heat. It lets a utility build an ISO/IEC 27001-conformant ISMS that reaches down to the OT layer instead of stopping at the IT boundary.
A note on sourcing: this guide's research fetch of ISO.org's own catalogue page for ISO/IEC 27019 did not return page content (an access error rather than rendered text). The scope, structure and edition-history details below are cross-checked across two independent secondary sources — the long-established ISO27k Toolkit community reference and Wikipedia's technical summary — which agree on every fact used here. Confirm any specific clause number or control count against ISO's own text or a purchased copy of the standard before citing it in a compliance submission.
What it covers — and the two explicit exclusions
Per corroborated secondary summaries of the standard's scope clause, ISO/IEC 27019 applies to:
- Central and distributed process control, monitoring and automation technology, including programming and parameterization devices used to operate it
- Digital controllers and automation components — control and field devices, PLCs, digital sensors and actuators
- Supporting information systems and communication technology used in the process control domain: networks, telemetry, telecontrol applications and remote control technology
- Digital protection and safety systems
- Energy management systems, including distributed energy resources (DER) and electric vehicle charging infrastructure in private, residential or industrial settings
- Digital metering and measurement devices (energy consumption, generation, emission values)
- The premises housing this equipment, and remote maintenance systems used to service it
Two exclusions matter for scoping a project correctly: the standard does not apply to the process control domain of nuclear facilities (that domain is covered separately by IEC 63096), and it does not apply to telecommunication systems and components used within the process control environment — a utility still needs separate telecom-specific security guidance for those links.
How it relates to ISO/IEC 27001 and 27002
ISO/IEC 27019 is not a standalone ISMS standard — it is a sector-specific supplement. A utility still certifies against ISO/IEC 27001 for its management system; ISO/IEC 27019 extends ISO/IEC 27002's generic control catalogue with energy-utility-specific controls and explicitly directs adopters to adapt ISO/IEC 27001's risk assessment and treatment process using the industry-specific guidance it provides, rather than applying unmodified generic risk language to a process control environment where safety and real-time availability constraints dominate over the confidentiality-first assumptions baked into much general IT security guidance.
Edition history: use the 2024 edition, not 2017
| Year | Status | Notes |
|---|---|---|
| 2013 | Technical Report | Based on DIN SPEC 27009; informative, not a full International Standard |
| 2017 | First edition (International Standard) | Published 27 November 2017; first full-status release |
| 2019 | Corrigendum | Technical correction to the 2017 text |
| 2024 | Second edition | Realigned to ISO/IEC 27002:2022's restructured theme/control set; reportedly adds around 12 new or re-scoped controls plus an edition-correspondence annex |
Treat any procurement or compliance language that just says "ISO/IEC 27019" as ambiguous — specify the 2024 edition (or whichever is current at contract time) explicitly, the same way a utility would cite a specific IEC 62443 part and edition rather than the series name alone.
How it fits alongside IEC 62443 and IEC 62351 for power utilities
ISO/IEC 27019 sits at the management-system layer, not the protocol or component layer, which is why utilities typically run it alongside other OT standards rather than instead of them:
- IEC 62443 — cross-sector industrial automation and control systems security: organizational programs, system requirements and component requirements, applicable to any OT sector, not just energy.
- IEC 62351 — protocol-specific: secures the actual IEC 61850, IEC 60870-5 and related TC 57 communication protocols a power utility's control systems exchange.
- ISO/IEC 27019 — management-system layer: extends an ISO/IEC 27001 ISMS with energy-utility-specific controls covering process control technology broadly, independent of which specific protocols or component standards are in use.
A utility aiming for a defensible OT security program typically needs all three working together: ISO/IEC 27019 for the ISMS extension and sector-specific controls, IEC 62443 for organizational/system/component requirements, and IEC 62351 for protocol-level cryptography on the wire.
A workable starting point
Confirm which edition a contract or auditor expectsThe 2017 and 2024 editions have materially different control sets; don't assume "ISO/IEC 27019" alone pins down a specific requirement. Scope out nuclear and telecom explicitlyIf a utility's portfolio includes nuclear generation or in-scope telecom links, document that those domains are covered by other standards (IEC 63096 for nuclear) rather than silently assuming ISO/IEC 27019 reaches them. Treat it as an ISO/IEC 27001 extension, not a replacementA utility still needs a conformant ISO/IEC 27001 ISMS; ISO/IEC 27019 supplies the sector-specific controls and risk-adaptation guidance layered on top. Pair it with protocol- and component-level standardsISO/IEC 27019 covers the management-system and control layer; IEC 62351 and IEC 62443 cover protocol and component security respectively — a complete OT security program for a power utility typically draws on all three. Re-verify clause numbers against the purchased standardThis guide summarizes corroborated secondary sources, not the paywalled standard text itself; don't cite a specific clause or control number in a compliance submission without checking it against ISO's own text.
SoftWSP's OT Snapshot builds a passive asset and protocol inventory for energy process control environments without touching live systems — useful groundwork before scoping an ISO/IEC 27019 gap assessment: see OT Snapshot.
This guide summarises independent secondary sources describing ISO/IEC 27019's scope and structure; it is not a substitute for the standard's own purchased text (available from ISO or national standards bodies) and does not constitute compliance or certification advice.
Sources
- ISO: ISO/IEC 27019:2017 catalogue record (official standard page — this guide's fetch of this URL did not return page content; listed for reference and re-verification)
- ISO27k Toolkit (iso27001security.com): ISO/IEC 27019 summary — scope, structure, relationship to ISO/IEC 27002, edition history
- Wikipedia: ISO/IEC 27019 — scope, exclusions, publication history (2013 TR, 2017 IS, 2019 corrigendum, 2024 second edition)
- IEC SyC Smart Energy: ISO/IEC 27000 series in the smart energy cybersecurity standards landscape
Frequently asked questions
What is ISO/IEC 27019 and who is it for?
ISO/IEC 27019, "Information security controls for the energy utility industry," is a sector-specific extension of the ISO/IEC 27000 family aimed at energy utilities — organizations involved in the generation, transmission, storage and distribution of electric power, gas, oil and heat, and the process control systems that run those operations. Per independent secondary summaries of the standard's own scope text, it is built on ISO/IEC 27002's generic control catalogue but adapts and supplements it for the real-time, safety-critical nature of process control and automation technology, letting a utility implement an ISO/IEC 27001-conformant ISMS that extends from the business level down to the process control (OT) level.
What systems does ISO/IEC 27019 cover, and what is explicitly excluded?
Per corroborated secondary summaries, the scope covers central and distributed process control, monitoring and automation technology and the systems used to operate it (programming/parameterization devices); digital controllers and automation components including PLCs and sensor/actuator elements; supporting information systems and communication technology used in the process control domain (networks, telemetry, telecontrol, remote control); digital protection and safety systems; energy management systems including distributed energy resources and electric-vehicle charging infrastructure; digital metering and measurement devices; and the premises housing this equipment, including remote maintenance systems. Two exclusions are explicit: the process control domain of **nuclear facilities** (covered instead by IEC 63096), and **telecommunication systems and components** used within the process control environment, which fall outside the standard's scope.
How is ISO/IEC 27019 structured relative to ISO/IEC 27002?
It does not replace ISO/IEC 27002's control catalogue — it supplements it. Per secondary summaries of the 2024 second edition, the standard follows ISO/IEC 27002:2022's four-theme control structure (organizational, people, physical, technological) and adds energy-utility-specific supplementary controls within each: reported counts include roughly 2 additional organizational controls, people-control guidance, 4 additional physical controls, and 6 additional technological controls, plus informative annexes giving industry-specific reference material and a correspondence table between editions. ISO/IEC 27019 also directs adopters to adapt the ISO/IEC 27001 risk assessment and treatment process using the sector-specific guidance it provides, rather than applying generic ISO/IEC 27001 risk language unmodified to a process control environment.
Is the 2017 edition still current, and what changed in the 2024 edition?
No — treat the 2024 edition as the current one. ISO/IEC 27019 began life as a 2013 Technical Report (based on DIN SPEC 27009), was published 27 November 2017 as the first full International Standard, received a 2019 corrigendum, and was then revised into a second edition published in 2024 to realign with the restructured ISO/IEC 27002:2022 control set, reportedly adding around 12 new or re-scoped controls in the process. This guide's research could not retrieve ISO.org's own catalogue page for the standard directly (the fetch returned an access error rather than page content), so the edition history above is cross-checked against two independent secondary sources rather than ISO's own listing — confirm the current edition and exact control count against iso.org or a purchased copy before citing a specific clause number in a compliance document.
In this cluster
