How to Audit ISO 27001 Annex A 7.12: Cabling Security

In this ultimate how to audit guide to ISO 27001 Annex A 7.12 Cabling Security, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.12 Cabling Security Audit Checklist

Auditing ISO 27001 Annex A 7.12 Cabling Security is a technical verification of the physical infrastructure carrying sensitive data and power. The Primary Implementation Requirement involves the physical segregation and hardening of conduits, providing the Business Benefit of ensuring communications integrity and preventing unauthorised data interception or infrastructure tampering.

This technical verification tool is designed for lead auditors to establish the physical integrity of power and telecommunications infrastructure. Use this checklist to validate compliance with ISO 27001 Annex A 7.12.

1. Telecommunications and Power Line Segregation Verified

Verification Criteria: Power and telecommunications lines are physically separated to prevent electromagnetic interference (EMI) and reduce the risk of simultaneous accidental damage.

Required Evidence: Physical inspection of internal cable trunking or conduit layouts showing a minimum separation distance (typically 50mm+) or shielded dividers.

Pass/Fail Test: If unshielded data cables are found bundled directly with high-voltage power lines in shared trays, mark as Non-Compliant.

2. Cabling Physical Protection and Conduit Usage Confirmed

Verification Criteria: Exposed cabling in public or uncontrolled areas is housed within secure conduits or armoured trunking to prevent tampering or accidental severing.

Required Evidence: Visual verification of secure cable routing in public hallways, basements, or external building faces.

Pass/Fail Test: If network or power cables are found dangling or accessible to the public without protective casing, mark as Non-Compliant.

3. Entry Point Physical Security Validated

Verification Criteria: Physical entry points for external telecommunications and power feeds into the building are secured and restricted to authorised facilities personnel.

Required Evidence: Physical sighting of locked cabinets or secure rooms for external service entry points (manholes, cable vaults, or telecom rooms).

Pass/Fail Test: If the building’s primary external cable entry vault is found unlocked or accessible to unauthorised tenants/visitors, mark as Non-Compliant.