What ISO/IEC 27019 is and why it matters for energy control systems
ISO/IEC 27019 is a sector-specific extension of ISO 27001/27002 designed specifically for process control systems in the energy industry: electricity, gas and heat generation, transmission and distribution, including water utilities that share similar architectures.
The standard adds specific controls for technologies that generic ISO 27001 does not cover in detail: SCADA, DCS and RTU systems, telecontrol protocols such as IEC 60870-5-104, IEC 61850 and DNP3, and the segregation between process control domain (PCD) networks and IT/corporate networks.
It is not a standalone obligation, but is typically adopted alongside ISO 27001 as a sector implementation guide, or required contractually by grid operators and energy regulators as evidence of maturity in managing control systems.
For an energy utility, applying ISO 27019 means having full visibility over process control systems - often distributed across wide territories with heterogeneous technologies - and being able to demonstrate actual segregation between PCD, IT and OT networks, not just on paper but in real network traffic.
ISO/IEC 27019
ISO/IEC 27019:2017 - Energy utility industry
Extension of ISO/IEC 27002 specific to the energy utility industry: generation, transmission, distribution, storage. Defines additional controls for process control systems and the Process Control Domain (PCD) that manages the energy infrastructure.
- 01Extension of the ISMS to the Process Control Domain (PCD)
- 02Segregation between corporate IT, process IT and control systems
- 03Hardening and monitoring of SCADA / DMS / EMS systems
- 04Lifecycle management of legacy assets with operational constraints
- 05Resilience and continuity of critical energy processes
For energy utilities and operators in the sector, MON5 passively observes SCADA/DMS/EMS traffic, recognises sector-specific protocols (IEC 61850, DNP3, IEC 60870-5-104), identifies missing segregation between PCD and corporate IT and monitors legacy assets without requiring invasive installations on PLCs/RTUs.
- →Energy protocol recognition (IEC 61850, DNP3, IEC 60870-5-104)
- →PCD / IT / OT segregation map
- →Asset inventory on RTU, PLC, IED, gateway
- →Anomaly detection compatible with operational constraints on legacy systems
- →Evidence for ENE-specific controls of the extended Annex A
- PCD (Process Control Domain)
- The domain of networks and systems dedicated to process control in energy plants, distinct from the corporate IT domain in ISO 27019 terminology.
- RTU (Remote Terminal Unit)
- Device that collects data from field sensors/actuators and transmits it to a central SCADA system, typical of electricity transmission and distribution networks.
- IEC 60870-5-104
- Telecontrol protocol widely used in European electrical grids for communication between control centres and remote substations.
- IEC 61850
- Communication standard for substation automation, defining data models and protocols for protection and control devices.
- DNP3 (Distributed Network Protocol)
- Communication protocol used in the energy and water sectors to exchange data between SCADA systems and remote devices.
- PCD/IT segregation
- Principle required by ISO 27019 whereby process control networks must be separated from corporate IT networks through verifiable technical controls (not just policy), to limit incident propagation between the two domains.
What is ISO/IEC 27019 and how does it differ from ISO 27001?+
ISO 27019 is an extension of ISO 27001 specifically for process control systems in the energy industry. It adds requirements for SCADA, DCS, RTUs and automation systems at utilities such as power, gas and water.
Does ISO 27019 apply only to the energy sector?+
ISO 27019 was developed for energy, but its OT-specific controls for process control systems are widely applied to other industrial sectors: water, gas, manufacturing and transport.
What ISO 27019 evidence can MON5 produce?+
Inventory of control systems (RTUs, PLCs, SCADA), traffic monitoring on IEC 61850, DNP3 and IEC 60870-5-104 protocols, documentation of PCD/IT/OT network segregation and anomaly detection.
Does ISO 27019 require a separate certification from ISO 27001?+
No, ISO 27019 applies as an extension of ISO 27001/27002 controls within the same ISMS; there is no standalone, separate ISO 27019 certification.
Which operators are typically required to adopt ISO 27019?+
Electricity transmission and distribution network operators, power generation plant operators, gas network operators and, by practical extension, water utilities with comparable SCADA/DCS architectures.
How is the PCD/IT segregation required by ISO 27019 verified?+
Through monitoring of real network traffic to confirm the absence of unauthorised communication paths between the two domains, not just a review of network diagrams that often do not reflect the plant's actual state.
Does ISO 27019 also cover the physical security of substations?+
Yes, the standard includes physical security controls for process control facilities alongside cyber controls, recognising the interdependence between physical and cyber protection in the energy sector.
Does MON5 support the visibility required by ISO 27019 over energy protocols?+
Yes. MON5 passively identifies assets and communications over the sector's typical protocols (IEC 60870-5-104, IEC 61850, DNP3) and verifies PCD/IT segregation in real traffic.
Let's figure out what you really need.
Show us the OT perimeter and the regulations you need to cover: we will tell you what MON5 documents directly, where complementary work is needed, and which tier to start from - no hard selling.