A.7.12 Cabling security
Protect power and data cabling from interception, interference and damage.
12
artefacts
2
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Incident logs of cable damage · Physical access / facilities
- Access badge swipe records for cable vaults · Physical access / facilities
periodic reviewEvidence produced at each review
- Risk assessment for cable exposure · Physical access / facilities
- Periodic cable integrity inspection reports · Physical access / facilities
- EMI/EMC test results for critical lines · Source control / CI pipeline
governing documentDocuments that govern the control
- Facility floor plan with cable routes · Policy repository / GRC workspace
- Network topology diagram showing physical links · Policy repository / GRC workspace
- Cable conduit layout drawings · Policy repository / GRC workspace
- Photos of cable trays and conduit installations · Policy repository / GRC workspace
- Cable shielding specification sheets · Policy repository / GRC workspace
- Visitor sign‑in sheets for data center cabling areas · Policy repository / GRC workspace
- Maintenance crew work orders with authorization · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Relying on informal sketches instead of approved diagrams
- Missing regular physical inspections of cable pathways
- Inadequate segregation of power and data cables
- Failure to control and log access to cable distribution points
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet