Cabling security

What the requirement asks

Cables that carry power, data or supporting information services are to be protected from interception, interference and damage. Purpose: keep cabling problems from causing information or assets to be lost, stolen, harmed or compromised, or from halting operations. Guidance: consider running power and telecommunications lines into processing facilities underground where possible, or otherwise protecting them adequately (for example floor cable protectors or poles), and shielding buried cables from accidental cuts with armoured conduit or markers; keeping power and communications cables apart to prevent interference; and labelling each end of every cable with enough source and destination detail for it to be physically identified and inspected. For sensitive or critical systems, consider armoured conduit, and locked, alarmed rooms or enclosures wherever cables can be inspected or terminate, electromagnetic shielding, periodic technical sweeps and physical inspections to find unauthorized devices attached to cables, access control on patch panels and cable rooms using keys or PINs, and fibre-optic cabling. Seek specialist advice on managing risks from cabling incidents or faults. Other information: co-located premises sometimes share power and telecommunications cabling between organizations. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Cabling security is physical and logical. The guidance asks for the route, the protection, the labelling and the inspection.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep cabling diagrams showing routes, protection (underground, conduit, protectors) and separation of power from data and one live sample together.

Evidence an assessor asks for

• Cabling protectionCabling diagrams showing routes, protection (underground, conduit, protectors) and separation of power from data
• Cabling protectionCable labelling at both ends matching the cabling records
• Cabling protectionAccess control records for patch panels, risers and cable rooms
• Cabling protectionRecords of technical sweeps and physical inspections for unauthorized taps on cables for sensitive systems
• Cabling protectionSpecifications showing armoured conduit, shielding or fibre used for critical systems
• Cabling protectionSpecialist advice or assessments on cabling risks, including for shared cabling in co-located premises

The question an assessor will ask

An assessor will ask for cabling diagrams showing routes, protection (underground, conduit, protectors) and separation of power from data, then trace it to the system it protects. For A.7.12 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Patch panels sit in unlocked cupboards in public corridors
• Cables are unlabelled, so unauthorized connections cannot be spotted
• Power and data run together, causing interference
• Shared cabling with other tenants is not assessed

Before the next audit

Before the next audit, check one live sample for this gap: patch panels sit in unlocked cupboards in public corridors.