Creation of a mapping for the standard DIN EN ISO/IEC 27019:2020

Operators of energy supply networks and energy plants are obliged to ensure adequate protection against threats to telecommunication and electronic data processing systems and thus an intact information and communication technology.

The Federal Network Agency for Electricity, Gas, Telecommunications, Post and Railway (BNetzA) sets requirements for network operators and generators. These are defined in the IT security catalogues that the BNetzA has developed together with the Federal Office for Information Security (BSI).

The BNetzA has also published requirements from the ISO standards 27001 and 27002 as well as 27019 in the IT security catalogues. Due to the revision of the ISO/IEC 27002 standard (third edition from February 2022), a compatible mapping had to be generated. This shows how the existing ISO/IEC 27019 is to be linked with the new structure of ISO/IEC 27002. The background: with ISO/IEC 27002:2022, the structure of the requirement elements has been changed significantly. Operators of energy supply networks and energy plants, auditors and other users of ISO/IEC 27019 are thus provided by the BNetzA with an aid for their work in the context of information security management systems.

secunet created this mapping for the BNetzA, coordinated it with the standardisation committees and prepared it for use by the energy sector.