A.7.12
Cabling security
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
The purpose is to treat cabling as part of the information infrastructure rather than as building fabric. Cable runs cross ceilings, risers, and shared building space that lies outside the rooms anyone has been made responsible for, so a run that nobody owns quietly undoes the protection applied at both ends of it. The organization should keep power supply and data transmission continuous and reduce the risk of signal interception, electromagnetic interference, and cable cutting or damage along cabling runs. In doing so it prevents service interruption from cable damage (availability), interception of information in transit (confidentiality), and data tampering or unauthorized device connection through manipulation of the cabling (integrity).
Key checkpoints
- Are power and telecommunications/data cables routed along paths with low risk of physical damage, interception, and interference (cable ducts, underground conduits, protective trays)?
- Are power and telecommunications lines routed separately to prevent signal errors or damage from electromagnetic interference (EMI)?
- Is physical access controlled to wiring rooms (MDF/IDF), frames, patch panels, and cable junction points?
- Are cables, ports, and patch panels labeled and is the cabling diagram kept current to prevent miswiring and unauthorized connection?
- Are additional protections such as shielded cable, fiber optics, conduit locking, and electromagnetic shielding applied to segments carrying sensitive information?
- Are unused cables and ports removed or disabled rather than left in place, and is the attachment of unauthorized tapping devices checked?
Implementation guidance
- Route power and telecommunications/data cables through underground conduits, inside walls, or in protective trays and ducts wherever possible to reduce physical damage and exposure to unauthorized access.
- Separate power and telecommunications lines by adequate clearance or use metal conduit or shielded cable to prevent electromagnetic interference.
- Apply locks and access control to wiring rooms (MDF/IDF), frames, patch panels, and junction boxes, and keep records of access.
- Label all cables, ports, and patch panels and keep the cabling diagram current to prevent miswiring and unauthorized change, updating the diagram immediately whenever changes occur.
- Protect sensitive segments with fiber, shielding, locked conduit, and access monitoring according to risk. Do not assume fiber or shielding alone prevents interception or ensures confidentiality; use peer authentication and encryption where required.
- Remove unused cables and network ports, or disable them physically or logically, and confirm through periodic inspection that no unauthorized junction points or tapping devices are attached.
- Provide redundancy for critical segments over physically separate alternate cabling routes so a single cable fault does not cause a full service outage.
Evidence
- Cabling diagram, and labeling and management register for cables, ports, and patch panels
- Status of access control and locking for wiring rooms (MDF/IDF) and frames, and access records
- Records of power/telecommunications line separation and shielding/conduit application (photos, installation and inspection records)
- Records of removal or disabling of unused cables and ports
- Cable inspection and tap detection records and follow-up actions
- Configuration and test records for cabling redundancy (alternate routes) on critical segments
Nonconformity examples
- Telecommunications or power cables are exposed on floors, ceilings, or corridors without protection, leaving them vulnerable to physical damage or unauthorized access.
- Power and telecommunications lines run adjacent to each other, causing signal degradation or errors from electromagnetic interference.
- Wiring rooms or frames are left open without locks, so anyone can reach cable junction points.
- Cables and ports are unlabeled and the cabling diagram is outdated and inconsistent with the actual wiring, so miswiring or unauthorized connection cannot be identified.
- Unused network ports or cables remain active, allowing unauthorized device connection or attachment of tapping devices.
- Critical circuits are routed over a single path only, so a cable cut or damage causes a full service outage.