Cabling security

Plain-language summary

Protecting the power and data cables that feed your systems from interception, interference, damage and theft — routed, separated, labelled and enclosed so that a cut or a tap neither takes systems down nor leaks information.

What the clause is really asking

Cables are easy to overlook until a contractor cuts one, a forklift crushes a tray or thieves strip copper from a duct. This control asks you to guard the cabling that carries power and communications to your systems against tapping, interference and physical harm. Practical measures include running cables underground or in protected conduit where possible; separating power and data cables to avoid interference; labelling both ends and keeping cabling records; locking patch panels and cabinets; avoiding routes through public areas; using fibre for sensitive links or where interference is high; and inspecting periodically for damage or unauthorised connections. For critical systems, consider armoured conduit and alternative routes. The misunderstanding is that cabling belongs to the electrician and is not an ISMS concern. In manufacturing, cable trays run past welding, presses and moulding lines, bringing both electrical interference and impact damage, and production network cables are often unlabelled. In South Africa, copper cable theft regularly cuts power and telecoms, so the external feeds into the site and the provider's route deserve attention.

What auditors look for

Auditors walk cable routes in the server room, risers and production areas, looking for unprotected cables, exposed patch panels, power and data sharing a tray, and unlabelled cables. They ask for cabling diagrams and check a few runs against what is installed. They ask how sensitive links are protected and whether critical connections have an alternative route. They look at where external cables enter the site. The hard question: if the cable into this building were cut tonight, what would stop, and how would you know?

Typical evidence

Cabling diagrams and records; cable labelling scheme; locked patch panels and network cabinets; separation of power and data cabling; protected conduit or trays on exposed routes; cabling inspection records; diverse routing for critical links; records of cable damage or theft and the response.

How to comply — recommendations

Commission or update a cabling diagram for the server room, risers and main production network routes, labelling both ends of every cable as you go. Lock patch panels and network cabinets. Separate power from data in shared trays or use shielded cable. Protect exposed runs on the shop floor with steel conduit or high trays away from forklift routes and heat sources. Ask your telecom provider about route diversity and add a second path for critical services. Inspect cable routes once a year and after any building work.

Common nonconformities

No cabling diagram or labels; patch panels accessible to anyone; power and data run together, causing interference; exposed cables damaged in production areas; a single external cable route for all communications; cable damage and theft not considered in the risk assessment; unauthorised devices found connected to network ports.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.