ISO 27001 Annex A 7.12: cabling security without the rats' nest

The due-diligence questionnaire asks how you protect network cabling. You are cloud-first, so you assume the question is about someone else's data centre. Then the auditor asks to open the comms cabinet, and behind the printer sits a cupboard of unlabelled patching.

This guide covers ISO 27001 Annex A 7.12 for UK regulated firms of 25 to 250 staff: scoping, the cable path walk, labelling, separation, tamper defences, shared buildings, evidence and the on-site audit test.

What does ISO 27001 Annex A cabling security require?

ISO 27001 Annex A 7.12 requires power and network cabling to be protected from three failure modes: damage, interference and interception. The ISO 27002 guidance adds a label at both ends of each cable. Protection means physical routing, separation and locked termination points, and the cabling that matters is whatever carries your power or data through the building.

The control reads harder than it is. In practice, ISO 27001 cabling security comes down to three failure modes and one habit:

• Damage: a contractor's drill, a rodent, a vacuum cleaner dragged across a floor-level run.
• Interference: power and data cables crowded together until the signal corrupts.
• Interception: a listening device clipped onto an exposed run, or a patch panel sitting in an unlocked cupboard.
• Identification: a label at both ends, so the person doing maintenance knows what they are about to unplug.

The control leans on physical entry controls (A.7.2) to keep the rooms where cables terminate locked. It also protects the connectivity that the supporting utilities control (A.7.11) treats as critical. If your premises already have a locked comms space and a sensible power supply, you are part-way there.

Most of what it asks for is good practice you probably want anyway: a tidy cabinet, labels you can read and a lock that works. The rest of this guide gets you there with an afternoon here and a few days there, not a project.

Does ISO 27001 Annex A 7.12 apply if you are cloud-first?

Yes. A cloud-first company still has an ISP line entering the building, a comms cabinet, switches and wall ports, and A.7.12 covers exactly that estate. The data-centre cabling belongs to your cloud provider; the office cabling belongs to you, and auditors check that your scoping reflects the difference.

The ISP demarcation point is where responsibility passes from the provider to you. Everything from that point inwards, including the run to your cabinet, is yours to protect. The estate in scope is smaller than a data centre and more exposed than most teams assume:

• the ISP line where it enters the building, and the point where it ends
• the comms cabinet and its patch panels
• switches and wireless access points fed by that cabling
• wall ports at desks and in meeting rooms

Hybrid firms with a small server room have more to protect. The principle is identical for a firm whose only on-premises kit is a router and one switch.

The pitfall is scoping the control out of the Statement of Applicability with a one-line "we are in the cloud" justification. The premises contradict that exclusion the moment someone walks the office and finds the cabinet. A scoped-in entry that says "small estate, low effort, here is the evidence" survives the same walk, and it costs you far less than defending an exclusion.

How do you audit your cable paths from ISP entry to comms cabinet?

Walk the cable path once, end to end: where the ISP line enters the building, where it runs, where it terminates and who can touch it along the way. In a multi-tenant building the walk includes the shared riser. Record each stretch's protection, then fix gaps in order of exposure.

The walk takes five steps, in this order:

1. Find the ISP entry point. Note where the line comes through the wall or floor and what covers it.
2. Follow each run. Record whether it sits in tray, conduit or an underfloor void, or runs loose along a skirting board.
3. Check the crossings. Anything crossing a floor needs a proper protector, not gaffer tape.
4. Visit every termination. Note which cabinets and patch panels are locked, who holds the keys and whether any panel sits in a shared or public space.
5. Ask who else can reach it. In a multi-tenant building, ask the landlord to show you the riser.

Sort the findings by exposure. A patch panel in a shared corridor goes to the top, because moving or locking it is the highest-value fix on the list. A loose cable behind a desk goes lower.

Budget a few days for a single office, and do it alongside the equipment siting work (A.7.8), because it is the same walk. An office move or fit-out is the cheapest moment to correct the routing. The output is a simple routing map plus a dated list of fixes, which becomes the first page of your evidence pack.

Do you really have to label every cable at both ends?

Yes. The 2022 guidance in ISO 27002 makes labelling at both ends explicit, with enough source and destination detail to identify and inspect the cable. We also recommend naming the service it carries. The label is what lets a technician change one connection in thirty seconds instead of causing an outage by pulling the wrong plug.

Picture a switch failing at 4pm on a Friday. With labelled cables, the engineer moves one connection and client work resumes. Without them, they trace runs by hand while the office waits. An afternoon with a label printer covers most small offices, and the same pass is when you reconcile the patch schedule against what is physically plugged in.

A comms cabinet the paperwork cannot describe is a cabinet nobody can safely touch.

The pitfall is the comms cupboard as archaeology: years of unlabelled patching that nobody dares disturb. That is an availability incident on a timer. An auditor who opens the door also reads the tangle as a proxy for your wider operational discipline.

Labels decay, too. Every office reshuffle moves cables, so give the labels and the schedule a named owner and a trigger for updating them, such as any desk move that touches the cabinet.

How far apart should power and data cables be?

Keep mains power and copper data cables roughly 20cm apart, cross them at right angles where they must meet, and use shielded or fibre cable where the building leaves no room. Auditors look for evidence that you considered interference, not for a tape measure on the trunking.

Interference is a quiet failure. Parallel power and data runs pressed together can corrupt signals, so users see slow or flaky links and nobody suspects the trunking. Work down this order of preference:

1. Separate them. Leave roughly a hand-span between mains and copper data runs.
2. Cross at right angles where the two paths have to meet.
3. Shield the data cable where the building forces the runs together.
4. Use fibre where there is no room at all, since it is immune to electrical interference.

The common failure is convenience. Power strips and data cabling get pushed through the same tight trunking on install day, then forgotten. Spot these during the path walk and log each one as a fix.

Evidence here is light. A photo of a separated run, or a line in the risk assessment explaining why shielded cable was used where trunking is shared, shows the thought process an auditor wants to see.

How do you stop cabling being tapped or tampered with?

Put cabling inside protection and behind locks. Run cables through trays, conduit or underfloor voids, lock comms cabinets with managed keys, and blank off unused ports so meeting-room sockets are not live. Prefer fibre for sensitive or building-to-building links, because it is hard to tap quietly.

Three public sources support that approach:

• For network-connected security systems such as CCTV and access control, the NPSA Network Connected Security Technologies Guidance advises preventing unauthorised physical access to the computers, network equipment and cabling that deliver them.
• NIST SP 800-53 Rev. 5 PE-4 Access Control for Transmission says controls on distribution and transmission lines prevent accidental damage, disruption and physical tampering, and may also be needed to stop eavesdropping on unencrypted transmissions. Its examples include locked wiring closets, locked or disconnected spare jacks, and cable run in conduit or trays.
• The NCSC Cyber Security Design Principles make the underlying point: an attacker can only target what they can reach, so reduce what they can reach.

Interception risk is real but situational: it matters most where your cabling crosses pathways other people can open, which the next section covers. In most offices the likelier failure has no attacker in it at all, such as a contractor's drill or a cable unplugged by mistake, and the same trays and locks deal with both.

The key is the weak point more often than the lock. A key left in the cabinet door, or copied freely, turns the lock into decoration. Keep a short register of key holders and review it when people leave. That register is also your access evidence.

What if the cabling runs through a building you do not control?

You cannot conduit a landlord's riser, but you can assess it. Ask building management to show you the shared pathway, raise exposures, record the reasoning in your risk assessment, and prefer encrypted links for anything transiting shared pathways. Add periodic visual checks only where data sensitivity or shared access justifies them.

Come to the riser visit with specific questions:

• Who holds keys or badges for the riser and the cupboards in it?
• Is the door locked, and does the building log who enters?
• When did contractors last work in the space, and for whom?
• Do other tenants' cables share the same tray as yours?

Write the outcome into the physical risk assessment: the exposure, who controls the pathway, your decision and the compensating control. If the landlord refuses access, record the refusal and rely on encryption. That entry is what turns a shared-building worry into defensible evidence.

The opposite failure is copying a data-centre template. Armoured conduit and technical sweep regimes in a 30-person office that needed labels and a lock waste budget and still leave the real gaps open.

What evidence do auditors expect for cabling security?

Auditors expect a cable routing map and patch schedule that match the cabinet, plus proof of access arrangements and inspections: photos of protected runs, key or badge records, the physical risk assessment, dated inspection notes and your Statement of Applicability entry. Keep it current by folding cabinet checks into a recurring facilities ticket.

The pack is short:

• Routing map and patch schedule, current to the last office change.
• Photos of protected runs, separated power and data, and labelled ends.
• Access arrangements for comms rooms and cabinets, with key holders and any entry records.
• Physical risk assessment or site walkthrough covering cable paths, including shared-building pathways.
• Inspection notes with dates, findings and fixes, wherever you claim periodic checks.
• Statement of Applicability entry showing how the control is scoped for your premises.

A rough map that matches the cabinet helps you more than a polished one that does not.

Documentation frozen at fit-out isn't documentation. It is a map of an office that no longer exists.

Cabling is physical, so automation is modest here, and the useful mechanism is a recurring facilities ticket. Each run checks the lock, compares a sample of labels with the schedule, photographs the cabinet and logs any fix. The ticket history is itself dated inspection evidence, and nobody has to remember to produce it.

What do auditors test in the comms room?

Auditors verify this control by looking. They open the comms cabinet, trace a cable or two against the patch schedule, check locks on termination points and follow visible runs for unprotected stretches. A mismatch or unlocked cabinet usually grades minor; an accessible termination point in a shared space handling sensitive data can grade major.

Expect questions like these during the site tour:

• Where does your internet connection physically enter the building, and what protects it on the way to your comms room?
• Open this cabinet. What is this cable, and where does it go?
• Who else in the building can reach your cabling, and how do you know?
• What stops someone unplugging the wrong thing during maintenance?
• When did anyone last look at these runs for damage or anything unexpected?

The trace is the moment that counts. A schedule that disagrees with the panel undermines every other document you have shown, so rehearse it yourself. Pick three cables at random, follow each to its far end and correct whatever the label or schedule gets wrong.

Certification bodies typically grade minor findings such as an unlocked cabinet, unlabelled patching or a documentation mismatch one at a time. Repeated minors can aggregate into a major as a pattern, which is why a single tidy-up pass matters more than a heroic fix of one cable.

Frequently asked questions