ISO 27001 A.7.12 - Cabling Security

Requirement

“Cables carrying power, data or supporting information services shall be protected from interception, interference or damage.”

Plain-language meaning

Cables are part of the information processing environment. If they are badly routed, unprotected, mixed incorrectly, poorly labelled, or accessible to unauthorized people, they can cause outages, interference, safety issues, interception, or tampering.

Why this matters

Weak cabling can create availability, integrity, confidentiality, and safety risks. Loose cables can be damaged or disconnected. Unclear labels can lead to incorrect connections. Power and data in the same conduit can create interference. Exposed communications cables can be tapped or damaged.

Implementation guidance

1. Protect cables from physical damage

Controls may include:

• proper cable trays, conduits, trunking, or raised-floor routing;
• avoiding loose cables on floors or walls;
• strain relief for connectors;
• protection against pulling, crushing, bending, water, heat, and pests;
• secure routing through controlled areas;
• regular inspection of cable condition.

2. Protect cables from interference

Power and data cables should be routed and segregated where required to reduce interference.

Examples:

3. Protect cables from interception and tampering

Where communications cables carry sensitive or critical information, consider:

• locked equipment rooms;
• locked communications boxes;
• protected conduits;
• controlled access to patch panels;
• tamper-evident inspection;
• encryption for sensitive transmissions;
• provider discussions for external junction boxes or street cabinets.

4. Maintain cabling documentation

Documentation should show power and communications routes, patching, labels, colour coding, cabinets, rooms, and external provider handoff points.

Audit guidance

Auditors should verify:

• cabling is properly routed and protected;
• connectors are protected from damage;
• power and data cabling are segregated where required;
• cables are labelled or colour-coded;
• network cabling between rooms, floors, or buildings is protected;
• patch panels and communications cabinets are locked where needed;
• external telecommunications junctions are considered in risk assessment;
• encryption or other transmission controls are used where interception risk justifies them.

Evidence examples

Strong evidence

• Cable routes are documented and match the site.
• Power and data segregation is implemented where needed.
• Patch panels and communications rooms are access-controlled.
• Exposed or external cable routes are risk-assessed.
• Inspection records identify and correct poor routing or damage.

Weak evidence

• Loose cables run across floors or walls.
• Patch panels are unlocked or unlabelled.
• Cable diagrams are missing or stale.
• Power and data cables are mixed without assessment.
• External junction boxes are ignored.
• Encryption is assumed to compensate for physical exposure without risk analysis.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.1 Physical Security Perimeters
• A.7.3 Securing Offices Rooms and Facilities
• A.7.8 Equipment Siting and Protection
• A.7.11 Supporting Utilities
• Risk Assessment
• Cabling Route and Protection Register
• Cabling Inspection Checklist
• A.7.12 Audit Evidence Pack
• A.7.12 Audit Checklist

KB-ready summary

• Protect cabling from physical damage.
• Segregate power and data where interference is plausible.
• Lock and control patch panels and terminations.
• Document cable routes and labels.
• Consider external telecoms weak points.

Templates and checklists

• Cabling Route and Protection Register
• Cabling Inspection Checklist
• A.7.12 Audit Checklist