01 · Control
Process control & automation
Central and distributed control, monitoring, automation and the systems used to operate or configure them.
ISO/IEC 27019:2024 · Energy utilities
Connect energy controls to the real system.
Bring process-control assets, supporting IT, suppliers, threats, risk decisions and evidence into one operating model for ISO/IEC 27019—without treating energy security as a detached checklist.
STORM supports implementation governance and evidence. It does not reproduce licensed ISO/IEC standard text or replace an accredited certification body.
Energy control landscapeRisk context active
Controllers & PLCsControl and field devices
SCADA / DMS / OMSMonitoring and operations
AMI & smart gridDistributed components
Remote maintenanceExternal access & suppliers
Asset context · risk · controls · evidence
2024 editionsecond edition, published in October 2024
ISO/IEC 27002sector guidance built on the 2022 control framework
4 energy domainselectric power, gas, oil and heat
Non-nuclear scopenuclear process-control systems are covered elsewhere
What the standard reaches
More than office IT. A connected operational landscape.
ISO/IEC 27019 applies sector-specific control guidance to the systems used to produce, transmit, store and distribute energy and to the supporting processes around them.
02 · Field
Controllers, PLCs & devices
Digital controllers, field equipment, sensors, actuators and related automation components.
03 · Network
Telemetry & communications
Process-control networks, telecontrol applications, telemetry and remote-control technologies.
04 · Grid
AMI & smart-grid components
Smart meters, distributed grid components and energy-management environments including DER and charging infrastructure.
05 · Safety
Protection & safety systems
Protection relays, safety PLCs, emergency mechanisms and other digital protection environments.
06 · Support
Supporting systems & premises
Supporting applications, historians, reporting systems, software, firmware, facilities and remote-maintenance systems.
Where STORM fits
Put IT, OT and governance in one risk view.
STORM identifies IT and OT assets, dependencies and risks, then connects policies, suppliers, technical findings, incidents and evidence around them—without claiming that a tool can decide control applicability for your organisation.
IT/OT cartography
Inventory physical locations, services, data, hardware, software, infrastructure, users and suppliers, then model their internal and external dependencies for scope and impact analysis.
Assets · dependencies · flowsRisk assessment & treatment
Use STORM-RM, ISO/IEC 27005 or a configurable methodology to connect impact, threats and vulnerabilities to risk criteria, treatments, owners, acceptance and review dates.
Risk register · treatment planThreats & vulnerabilities
Combine CVE and breach intelligence with Nessus and Microsoft Defender findings, asset correlation, CVSS and known-exploited status, SLA tracking and assigned remediation.
Technical risk · remediationPolicy & control evidence
Maintain document templates, versions, reviews, approvals and acknowledgements; map policies to controls and retain a complete audit history with automated reminders.
Governance · traceabilitySupplier security
Relate suppliers to supported assets and services, assess business impact and security posture, collect control evidence, tier risk and monitor remediation or exit decisions.
Third-party riskMonitoring & assurance
Continuously validate supported Microsoft configurations, pre-populate applicable assessment evidence, track findings and feed audits, KPIs and management reviews from the same operating record.
Monitoring · audit · review
Define the environment
Scope from dependencies, not from a spreadsheet.
Energy control environments combine operational equipment, supporting applications, networks, premises and external maintainers. STORM Cartography explicitly supports IT and OT assets and makes their service, process and supplier dependencies reusable across impact, threat and risk assessment.
- Identify physical locations, data, hardware, software and users
- Connect systems to operational services and external dependencies
- Export asset inventories and carry context into risk workflows
Use current context
Bring threats and vulnerabilities into control decisions.
STORM aggregates CVE and breach intelligence and centralises technical findings from supported sources. Teams can correlate vulnerabilities with Cartography assets, prioritise with CVSS and known-exploited context, and follow SLA-driven remediation while control applicability remains an organisational risk decision.
- FortiRecon, Nessus and Microsoft Defender integrations
- CVSS, CISA KEV context and historical remediation metrics
- Assigned tickets, exception and risk-acceptance workflows
Keep evidence alive
Review control signals between assessments.
Through Microsoft Graph, STORM continuously evaluates supported device, identity and security configurations across Entra ID, Intune, Defender, Azure, Sentinel and Microsoft 365. Results become historical, reviewable evidence alongside risks, findings and accountable remediation.
- Configurable thresholds, grace periods and severity levels
- Automatic implementation-status evaluation and evidence generation
- Inputs for compliance assessment, audit and management review
Aligned to ISO/IEC 27002:2022
01
02
03
04
Four control themes. One connected operating record.
The 2024 edition aligns its controls with the organisational, people, physical and technological themes used by ISO/IEC 27002:2022.
Organisational
Connect policies, roles, asset ownership, suppliers, incidents and continuity with internal audits, measurable objectives and documented management reviews.
Policies · suppliers · audits · management reviewPeople
Use granular RBAC, accountable owners, policy acknowledgements and tracked responsibilities to turn written expectations into reviewable action.
Roles · ownership · acknowledgementsPhysical
Keep sites, physical assets and equipment inside dependency, impact and treatment decisions even where safeguards operate outside the GRC platform.
Inventory · impact · treatment evidenceTechnological
Correlate configurations, vulnerabilities, threat intelligence, monitoring evidence and remediation with affected assets, risks and responsible owners.
Monitoring · vulnerabilities · remediationThese summaries describe operating themes, not the licensed control text. Obtain the official standard and determine applicable controls through your organisation's risk-management and ISMS processes.
Implementation workflow
01
02
03
04
From scope to reviewable evidence.
Use STORM to organise the implementation record while qualified teams retain responsibility for interpretation and control selection.
Scope
Identify process-control assets, supporting systems, services, sites and external dependencies.
Cartography · suppliersAssess
Evaluate operational impact, threats and vulnerabilities using defined risk criteria.
Impact · threat · scenariosTreat
Select controls and actions, assign owners and document risk acceptance or remediation.
Treatment · policies · tasksReview
Maintain evidence, monitor changes and report status through management and audit workflows.
Monitoring · evidence · reportingPractical questions
Keep the standard, the platform and the assurance decision separate.
A credible implementation does not turn guidance into a product promise.
Who is ISO/IEC 27019:2024 intended for?
The official scope covers energy utility environments involved in producing, transmitting, storing or distributing electric power, gas, oil and heat, including process-control technology and supporting systems. The nuclear process-control domain is outside its scope.
Does ISO/IEC 27019 replace ISO/IEC 27001 or ISO/IEC 27002?
No. ISO/IEC 27019 provides energy-utility controls based on ISO/IEC 27002:2022. It is intended to add sector context for process-control and automation environments, while ISO/IEC 27001 defines ISMS requirements.
Does STORM include the official licensed standard text?
This page makes no such claim. Organisations should obtain the official standard through ISO, IEC or an authorised national standards body. STORM is presented here as the platform for organising scope, risk, treatment, ownership and evidence.
Does the standard itself provide a stand-alone certification?
This page treats ISO/IEC 27019 as sector-specific control guidance and does not promise stand-alone certification. Confirm the appropriate assurance or certification route with an accredited certification body and your official standards provider.
Can STORM support both IT and OT governance?
STORM's documented asset model includes systems, hardware, software, infrastructure, services, processes and suppliers. Its risk, policy, incident, threat, monitoring and evidence workflows can use that context. Technical OT controls still have to be designed and operated by the responsible engineering and security teams.
Bring your energy environment
Book a STORM demo
See the standard through the assets and risks that matter.
Use a focused walkthrough to test STORM against your control systems, supporting IT, suppliers, threat sources, risk method and evidence requirements.