ASD ISM 0926 Ensure cables are not salmon pink or red
What it says
Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not use salmon pink or red for non-classified, sensitive, or protected cables.
When setting up your network cables, make sure they're not coloured salmon pink or red if they're for everyday use and not intended for classified, sensitive, or protected information. This matters as certain colour codes are reserved for specific purposes, and using these colours wrongly can lead to confusion or accidental mishandling of sensitive data.
Free. Save your status, tasks and notes.
Why it matters
Using salmon pink or red cables for non-classified, OFFICIAL: Sensitive or PROTECTED links can cause misidentification and increase mishandling risk.
How to implement
IT team should review existing cabling: Conduct an audit of all current cables in use to check if any are salmon pink or red and replace them as necessary.
Use a checklist to ensure all office areas are covered during the inspection.
Procurement should source compliant cables: When purchasing new cables, ensure they are not salmon pink or red unless specifically required for classified systems.
Request sample swatches from suppliers to confirm compliance before ordering.
Office managers should educate staff: Organise a short briefing with employees about cable colour codes and their importance.
Use visual aids like charts showing acceptable cable colours and distribute a one-page guide for quick reference.
Facility managers should label network cables: Consistently label all network cables by their function and purpose, avoiding salmon pink and red for non-sensitive uses.
Use colour coding charts to match labels to the correct colours.
Compliance officers should update policies: Ensure internal policies reflect this control by including a section on cable colour coding for all new installations and upgrades.
Review the policies with relevant team leads to guarantee understanding and adherence.
Keep it running
Inspect cabling periodically to confirm salmon pink/red are not used for non-classified, OFFICIAL: Sensitive or PROTECTED runs. Set procurement rules to block these colours.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cable inventory list: Request documentation showing the inventory of all network cables in current use within the organisation.
Look at
Notations on cable colours and their respective use cases.
Good evidence
Is a complete list showing no use of salmon pink or red for non-sensitive cables.
- Check 2 of 5What an auditor asks for
Ask for
The procurement records: Review procurement documentation for recent cable purchases.
Look at
The description of products purchased to ensure compliant colours are chosen.
Good evidence
Shows no salmon pink or red cables ordered for non-sensitive data.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records: Request records of training sessions or briefings given to staff regarding cable colour policies.
Look at
Attendance lists and session content.
Good evidence
Shows completed training with clear focus on adhering to the colour scheme.
- Check 4 of 5What an auditor asks for
Ask for
A sample of labelled cables: Visit the facility and request to inspect an area of the network cabling.
Look at
The actual cable labels and their colours.
Good evidence
Is that all network and patch cables follow the colour guidelines with no salmon pink or red used incorrectly.
- Check 5 of 5What an auditor asks for
Ask for
The colour coding policy document: Request the internal policy that dictates cable colour usage in the organisation.
Look at
Specific details on allowable and prohibited colours.
Good evidence
Includes a well-defined policy that limits red and salmon pink to specific, authorised uses only.
Mappings
Closest match in ISO/IEC 27001: A.5.13, Labelling of information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.13.
ISM-0926 mandates a specific labelling/identification convention by prohibiting salmon pink and red for certain sensitivity/classification levels of cables. This aligns with Annex A 5.13, which requires procedures for information labelling in accordance with an organisation's classification scheme, and cable colour can be part of that labelling scheme for physical assets. Annex A 5.13 is broader (covers all information labelling methods and media), whereas ISM-0926 addresses only a narrow, cable-colour rule.
This control partially meets A.7.12.
ISM-0926 requires that non-classified, OFFICIAL: Sensitive and PROTECTED cables are not coloured salmon pink or red, to avoid misidentification of cable sensitivity/classification. This relates to Annex A 7.12 because consistent cabling identification is one practical measure that can support protecting cables from interception, interference or damage by ensuring handling and routing decisions are appropriate. However, Annex A 7.12 is broader and focuses on physical protection outcomes for cabling, while ISM-0926 is a very specific colour-standard requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.