How to Implement ISO 27001 Annex A 7.12

Implementing ISO 27001 Annex A 7.12 Cabling Security is an essential physical safeguard for protecting information transit lines from tampering and signal interference. The Primary Implementation Requirement involves hardening cable routes and enforcing physical separation, delivering the Business Benefit of ensuring high-integrity data transmission and resilient connectivity.

ISO 27001 Annex A Cabling Security Implementation Checklist

Use this implementation checklist to achieve compliance with ISO 27001 Annex A 7.12. This control requires that power and telecommunications cabling carrying data or supporting information services are protected from interception, interference, or damage through physical hardening and strategic routing.

1. Identify and Audit All Sensitive Cable Routes

Control Requirement: Power and telecommunications cabling must be protected from physical damage. Required Implementation Step: Trace every data and power line from the service entry point to the server room and workstations. Document the physical path in a site diagram, specifically noting where cables pass through public or shared areas (e.g., ceiling voids, risers, or underground ducts) that lack immediate surveillance.

Minimum Requirement: A master cabling map identifying “High Risk” segments where cables are exposed to potential tampering.

2. Enforce Physical Separation of Power and Data

Control Requirement: Cable interference must be minimised through adequate separation. Required Implementation Step: Inspect risers and under-floor trays to ensure data cables are physically separated from high-voltage power lines (at least 200mm unless shielded). Use distinct, colour-coded conduits or divided trunking to prevent electromagnetic interference (EMI) that could corrupt data or lead to signal leakage.

Minimum Requirement: Verified physical gap or grounded metal shielding between power and telecommunications lines.

3. Install Grounded Steel Conduit for Vulnerable Runs

Control Requirement: Protect cables from interception or damage in non-secure areas. Required Implementation Step: Enclose any cabling that passes through public hallways, car parks, or external walls in grounded, rigid steel conduit rather than plastic trunking. Plastic can be cut silently; steel requires power tools and creates enough noise to alert security.

Minimum Requirement: All cabling in “Public Zones” must be housed in rigid, tamper-evident metal piping.

4. Secure Distribution Points and Patch Panels

Control Requirement: Access to cabling termination points must be restricted. Required Implementation Step: Physically lock all patch panels and wall-mounted cabinets located outside the primary server room. Ensure the cabinets have “Door Contact” sensors integrated with the building alarm system to detect unauthorised opening of the distribution frame.

Minimum Requirement: Every cable distribution point must be housed in a locked, metal enclosure with key-holder logs.

5. Implement Tamper-Evident Seals on Inspection Hatches

Control Requirement: Detect unauthorised access to cable runs. Required Implementation Step: Apply uniquely numbered, tamper-evident holographic seals to ceiling tiles and floor hatches along sensitive cable routes. Conduct a monthly walk-through to verify these seals are intact; a broken seal indicates someone has accessed the void, necessitating a technical inspection for “taps.”

Minimum Requirement: A monthly log of tamper-seal inspections for all hidden cable pathways.

6. Use Shielded Twisted Pair (STP) for Sensitive Data

Control Requirement: Protection against electromagnetic induction and signal sniffing. Required Implementation Step: For runs carrying unencrypted or highly sensitive traffic, replace Unshielded Twisted Pair (UTP) with Shielded Twisted Pair (STP) or Foil Twisted Pair (FTP) cabling. Ensure the shielding is properly grounded at the patch panel to drain away EMI and prevent “emanations” that can be sniffed from several metres away.

Minimum Requirement: Installation of shielded cabling for all backbone runs and connections in high-interference environments.

7. Bury and Protect External Service Entries

Control Requirement: External telecommunications entries must be protected from sabotage. Required Implementation Step: Ensure the “Demarcation Point” (where the ISP enters the building) is located within a locked, concrete-walled room. External conduits must be buried at least 600mm deep and covered with “Warning” tape and concrete slabs to prevent accidental or malicious cutting by street-side intruders.

Minimum Requirement: Buried, concrete-protected entry conduits for all external data and power services.

8. Hard-Wire Critical Redundant Infrastructure

Control Requirement: Minimise the risk of single-point utility failure. Required Implementation Step: Ensure redundant data lines (e.g., Leased Line 1 and Leased Line 2) do not share the same physical conduit or entry point. If both cables enter through the same hole in the wall, a single person with a pair of snips can bypass all your “Logical High Availability.”

Minimum Requirement: Physical path diversity (separate conduits/entries) for all redundant network and power services.

9. Deploy Port Security and Physical Port Locks

Control Requirement: Prevent unauthorised device attachment to cabling. Required Implementation Step: Physically block unused RJ45 ports in public areas with keyed “Port Locks.” On the switch level, enable MAC address binding (sticky MAC) so that if an intruder unplugged a printer to plug in a laptop, the port would immediately shut down.

Minimum Requirement: Physical port blockers on all exposed wall sockets and active port security on managed switches.

10. Conduct Annual ‘Time Domain Reflectometry’ (TDR) Tests

Control Requirement: Periodically verify the integrity and security of cabling. Required Implementation Step: Use a TDR tester to measure the length and impedance of your backbone cable runs. A sudden change in cable length or a new “echo” in the signal indicates a physical splice or a bridge, likely a tap, which requires immediate forensic investigation.

Minimum Requirement: Annual baseline TDR reports for all critical inter-switch and server-room cabling.

ISO 27001 Annex A 7.12 SaaS / GRC Platform Implementation Failure Checklist

Control Requirement	The ‘Checkbox Compliance’ Trap	The Reality Check
Physical Protection	Checking a box saying “Cabling is secure.”	The GRC tool doesn’t see the CAT6 cable running across the office floor or the unlocked riser cupboard.
Interference Prevention	Uploading a PDF of the “Cabling Standard.”	If the electrician ran power and data in the same tray to save money, a PDF won’t stop the resulting packet loss or sniffing risk.
Interception Detection	Setting a recurring task for “Manual Inspection.”	Staff often “pencil-whipped” GRC tasks. Without TDR testing or tamper seals, a physical tap in the ceiling will never be found.
Service Diversity	Marking “High Availability” because of dual ISPs.	Most ISPs share the same physical “Trench” in the street. A GRC tool won’t tell you that one backhoe will cut both of your “redundant” lines.
Port Security	Linking to a policy on “Unauthorised Devices.”	Policies don’t block ports. If a visitor can plug a Raspberry Pi into a wall socket, your dashboard will stay green while your data is exfiltrated.
ISP Entry Security	Relying on the ISP’s ISO 27001 certificate.	The ISP is responsible for the network, not the physical box on your wall. If that box is unlocked, the ISP’s certificate is irrelevant.
Termination Points	Taking a photo of the main server rack.	What about the “B-block” termination in the basement? If that isn’t in a locked room, an attacker can tap the phone lines or serial consoles.

About the author