ISO 27019
What is ISO 27019?
Information security controls for the energy utility industry. It comprises 15 controls organised across 3 domains, published by ISO/IEC, and applies in International.
How ISO 27019 maps to other frameworks
All 15 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 3 domains ISO 27019 groups its controls into
Frameworks that share controls with ISO 27019
Each of these has at least one control mapped to a control in ISO 27019. The number is how many ISO 27019 controls are shared, counted from the mapping graph.
NIST SP 1800-32
16 shared controlsNIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
15 shared controlsNIST SP 800-53 Rev 5
13 shared controlsTISAX - Trusted Information Security Assessment Exchange
12 shared controlsNIST Privacy Framework
12 shared controlsMTCS (Singapore)
11 shared controlsNERC CIP
11 shared controlsIAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
11 shared controlsImplementation guides for frameworks that overlap ISO 27019
Where ISO 27019 overlaps with the standards you already hold
Where to get trained on ISO 27019
One course in the catalogue covers ISO 27019 directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 46 ISO 27019 controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the ISO 27019 evidence request listWhat ISO 27019 means in your sector
What ISO 27019 means for your job
Questions people ask about ISO 27019
What is ISO 27019?
How many controls does ISO 27019 have?
Where does ISO 27019 apply?
What frameworks does ISO 27019 map to?
How do I get started with ISO 27019 compliance?
Query ISO 27019 programmatically
ISO 27019, its 15 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
ISO 27019 API reference and MCP config →What ISO 27019 requires, control by control
Each page carries the requirement text for one ISO 27019 control and what an assessor expects to see as evidence.
- 02 System security categorization
- 04 Roles and responsibilities for critical systems
- 05 Security policy for operational technology
- 07 Personnel risk assessment
- 08 Electronic access perimeter management
- 10 Revocation of access procedures
- 11 Security patch management for OT
- 12 Malware prevention for operational systems
- 12-1-2 Change Management for Control Systems
- 12-2-1 Malware Protection in OT
How ready are you for ISO 27019?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.