7.12 Cabling security
Cables that carry power, data or supporting information services are to be protected from interception, interference and damage. Purpose: keep cabling problems from causing information or assets to be lost, stolen, harmed or compromised, or from halting operations. Guidance: consider running power and telecommunications lines into processing facilities underground where possible, or otherwise protecting them adequately (for example floor cable protectors or poles), and shielding buried cables from accidental cuts with armoured conduit or markers; keeping power and communications cables apart to prevent interference; and labelling each end of every cable with enough source and destination detail for it to be physically identified and inspected. For sensitive or critical systems, consider armoured conduit, and locked, alarmed rooms or enclosures wherever cables can be inspected or terminate, electromagnetic shielding, periodic technical sweeps and physical inspections to find unauthorized devices attached to cables, access control on patch panels and cable rooms using keys or PINs, and fibre-optic cabling. Seek specialist advice on managing risks from cabling incidents or faults. Other information: co-located premises sometimes share power and telecommunications cabling between organizations.
Source: ISO/IEC 27002:2022, 7.12. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Cable labelling at both ends matching the cabling records · Physical access / facilities
- Access control records for patch panels, risers and cable rooms · Vulnerability scanner / patch tooling
- Records of physical inspections and technical sweeps that look for unauthorized devices tapping the cables of sensitive systems · Physical access / facilities
- Specialist advice or assessments on cabling risks, including for shared cabling in co-located premises · Physical access / facilities
governing documentDocuments that govern the control
- Cabling diagrams showing routes, protection (underground, conduit, protectors) and separation of power from data · Policy repository / GRC workspace
- Specifications showing armoured conduit, shielding or fibre used for critical systems · Policy repository / GRC workspace
First move
Common gaps auditors find
- Patch panels sit in unlocked cupboards in public corridors
- Cables are unlabelled, so unauthorized connections cannot be spotted
- Power and data run together, causing interference
- Shared cabling with other tenants is not assessed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet