ISO 27001 A.7.12: Protect cabling and its connection points
Cabling security protects the physical connections on which information services depend. ISO 27001 Annex A.7.12 addresses exposure to interception, interference and damage affecting power, data and supporting information services. The practical concern is not just the cable specification: routes, connection points, shared spaces and maintenance activity can determine whether the connection remains protected.
What A.7.12 requires in practice
Annex A control 7.12 asks that power cables, data cables and cables supporting information services are protected from interception, interference and damage. The control considers the cable as a physical thing with a route, not just a line on a network diagram. Its parts are to know which connections matter and what they serve, to understand where they enter, pass through and end, to identify exposure to damage, tampering and interference, and to select suitable protection. It also touches on identification, so authorised people can tell connections apart without guesswork, while recognising that detailed route information is itself sensitive. The outputs are knowledge of key cable routes, protective measures for exposed sections and connection points, and controlled access to the information needed for maintenance. The standard does not impose one installation design or a fixed set of materials.
Know the route and the service it supports
Identify relevant connections and the services affected by their loss or interference. Consider where cables enter the premises, pass through shared areas and terminate. A network diagram showing devices may omit the physical route that creates a common failure point. The level of detail should support informed protection and maintenance decisions.
Use suitable identification so authorised personnel can distinguish connections without guessing. Labelling and controlled route information can reduce accidental disconnection, but detailed infrastructure information may itself need protection. Make it available to people who require it for their role rather than either publishing it freely or withholding it from those responsible for maintenance.
Select protection for the location
Competent specialists should assess exposure to physical damage and interference, including nearby activities and the relationship between different cable systems. Appropriate routing, protective arrangements or restricted access to connection points may be useful. The specific installation must follow applicable technical and safety requirements; a management-system guide cannot supply dimensions or electrical instructions.
Protection also needs to remain usable. A cable route that is routinely bypassed during temporary work may indicate that the approved arrangement does not support operations. Examine why staff use temporary connections and how those changes are authorised, protected and removed. A temporary cable should not become an unmanaged permanent dependency.
Why protecting cabling and connection points matters to the business
Cables are easy to forget until one is cut, unplugged or tapped. A single accidental disconnection in a shared corridor can take down a service, and an exposed data cable in a public area can be a route for interception. Understanding routes and connection points helps the organisation avoid common failure points and unexpected exposure. Where another party manages the building infrastructure, knowing the boundaries prevents false assumptions. Customers relying on stable connections expect them to be protected. At audit, cabling is checked by looking at communications rooms, risers and patch areas, so tidy, controlled and understood infrastructure reflects a well-run ISMS.
How to implement A.7.12
Begin with what the cables do, then look at where they go. Remember that shared cabling in multi-tenant buildings may sit beyond your direct control. Record what is yours, what is the landlord's and what is a provider's, so that nobody assumes a neighbour covers it.
- Identify the power and data connections that support important services and the consequences of losing or interfering with them.
- Trace where they enter the premises, pass through shared areas and end, noting any common failure points.
- Assess exposure to damage, tampering and interference, using specialist advice where needed.
- Choose protection for exposed sections and connection points, such as routing, protective arrangements or locked cabinets.
- Label connections so authorised staff can identify them accurately and avoid accidental disconnection.
- Control access to route and layout information, giving it to people who need it for their role.
- Include cabling in maintenance and change procedures and agree responsibilities where another party manages part of the infrastructure.
Illustrative construction example: excavation beside a site connection
A hypothetical contractor relies on a communications link between its project office and a site facility. A new groundworks activity is planned nearby, but the route information held by IT has not reached the team coordinating the works. The link is treated as a generic site service rather than a dependency supporting project records and communications.
The teams verify the relevant route through authorised, competent channels and incorporate it into work planning. They agree who can approve changes and what checks follow the work. Evidence connects the identified service with the protection decision and the completed verification. This example concerns coordination and information, not instructions for locating or working on live utilities.
Evidence and checks that reveal weak interfaces
Possible evidence includes controlled route information, identified connection points, access arrangements, approved changes and appropriate inspection results. These are implementation methods, not a prescribed cable register format. The ISMS needs enough information to show that selected protection is implemented and maintained without unnecessarily exposing detailed infrastructure data.
A useful review compares records with a representative authorised walkthrough, then follows a recent installation or modification into the operating arrangement. Ask who would recognise an unexpected change and how it would be reported. Technical testing or inspection must be authorised and carried out by suitable personnel; do not disconnect or probe live services casually.
Common failures include unsecured termination points, inaccurate labels, unexplained temporary routes and split ownership between landlord and tenant. Connect this control with physical access and network security. Operational control should ensure that a change approved in one team reaches the other responsible teams.
Close the gap between network and facilities control
Discuss infrastructure interfaces with Sterling, including implementation advice, documented responsibilities, learning and agreed Effivity ISO & GRC automation software. The wider programme can include scoped authorised vulnerability scanning and findings review. Continued support helps prepare the system for assessment; an independent body decides certification. Enrol in ISO/IEC 27002 Information Security Controls to connect physical cabling protection with the wider ISMS. Return to the physical controls overview.
Frequently asked questions
Must all cables be underground?
No universal routing method applies. Appropriate protection depends on the location, threats, technical requirements and feasibility. Obtain competent advice on the installation.
Does fibre remove all cabling-security risks?
No. Physical damage, access to connection points and shared routes can still affect the service. Evaluate the full installation rather than relying on the medium alone.
Can a landlord's cabling be outside our review?
Direct ownership may differ, but relevant dependencies still need consideration. Clarify the provider's responsibilities, available assurance and any treatment the organisation retains.
Coordinate cabling changes with service changes
Moving a desk, replacing equipment or adding a provider can affect physical protection. Include appropriate review before the change, update relevant records and confirm the resulting arrangement. Check that obsolete or abandoned connections do not create confusion or unintended access. The person approving a business change may need input from both facilities and IT.
Multiple connections also need an accurate dependency assessment. Two labelled circuits following the same exposed route can share a failure point. Where resilience is important, verify what diversity actually exists and relate it to redundancy decisions. Do not infer independence merely from different provider names or contract numbers.