ASD ISM 0208 Maintain a comprehensive cable register
What it says
A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification - source - destination - location - seal numbers (if applicable).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep a detailed record of each cable, including ID, colour, and location, to ensure proper cable management and security.
Keeping a detailed record of all your cables might seem like a minor task, but it's crucial for maintaining the security and efficiency of your network. Without a proper cable register, you could easily lose track of important cables, allowing for potential mix-ups or security breaches, which can lead to data loss or downtime.
Free. Save your status, tasks and notes.
Why it matters
Without a comprehensive cable register, cables can't be reliably traced (ID, colour, classification, source/destination, location, seals), increasing misconnection and undetected tampering risks.
How to implement
The IT manager should establish a cable register: Start by listing every cable currently in use, including details like its unique identifier, colour, the locations it connects, and any classification markings.
Use a spreadsheet or dedicated software to keep this easily searchable and up-to-date.
Facilities staff should be involved in mapping the cables: They can assist by physically tracing cables from their source to destination and noting their colours and locations.
Ensure all sections of the office or building are thoroughly covered.
An IT officer should categorise cables based on sensitivity: Work with the security officer to classify cables that handle sensitive data and make sure this classification is recorded in the register.
This helps prioritise security measures.
Assign someone to regularly update the register: This could be part of the IT support team's routine maintenance tasks.
Ensure any changes in cabling, such as additions, removals, or rerouting, are promptly entered into the register.
Conduct training for relevant staff: Educate those who manage or frequently interact with cables on the importance of updating the register.
Provide a straightforward process, like a simple form, they can use to report any changes in cable setup.
Keep it running
Reconcile the cable register with the physical cabling after installs/moves: confirm identifier, colour, classification, source/destination, location, and record seal numbers where used.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current cable register: It should list every cable by identifier and include details about colour, location, source, destination, and any applicable seal numbers.
Look at
Completeness and match these with actual cables.
- Check 2 of 5What an auditor asks for
Look at
Consistent update activity, especially after any known changes.
- Check 3 of 5What an auditor asks for
Ask for
How changes to cabling are communicated and logged in the register.
Good evidence
Will detail a clear process from physical changes to documentation updates.
- Check 4 of 5What an auditor asks for
Good evidence
Outcome is an accurate match with no discrepancies.
- Check 5 of 5What an auditor asks for
Look at
A clear process and responsibility assignment.
Good evidence
Document will outline steps for updates and designate who does this regularly.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.9.
ISM-0208 requires a cable register recording, for each cable, its identifier, colour, sensitivity or classification, source, destination, location and any seal numbers. A cable register is a specific inventory of cabling assets, so maintaining it contributes directly to the inventory of information and associated assets required by Annex A 5.9. Annex A 5.9 covers all information and associated assets and requires owners to be recorded, which the cable register does not specify.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.