Control A.7.12Cabling security
Cables carrying power, data or supporting information services must be protected from interception, interference or damage.
Cabling is the physical layer of everything above it, and it is protected mostly by being out of sight rather than by design.
The control covers three threats. Damage is the common one — cables in walkways, under desks, or in a riser shared with contractors. Interference is electromagnetic, which is why power and data separation matters. Interception is the one organisations assume away, and it is the reason patch panels and risers in shared buildings deserve a look: an unsecured cabinet in a corridor is an access point.
The practical implementation is routing, labelling, and physical protection of the points where cables are accessible — and keeping documentation current enough that somebody can tell which cable is which without tracing it, since undocumented cabling is what turns a small change into an outage.
How to put this in place
Cables can be tapped, cut or confused, and the project needs to know which you control. Open patch panels in public areas are the typical finding.
- Identify the power and data cabling that carries in-scope information and that you control.
- Keep it inside controlled spaces or conduits and lock patch panels and cabinets.
- Label cables and keep a simple record of routes.
- Separate power from data cabling where interference matters.
- For cabling outside your control, ask the landlord or provider for assurance.
Evidence an auditor usually looks for: a walk-through of cabinets and cable routes, cabling records, and landlord or provider assurance where relevant.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.