ASD ISM 1098 Segregate SECRET cable terminations using individual cabinets or division plates
What it says
SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet with a division plate between any SECRET cables and non-SECRET cables.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeeps SECRET cables apart from other cabling where they connect, so they cannot be cross-patched by mistake: give them their own cabinet, or a division plate in small systems.
When a cable reaches its end point and is connected to a patch panel or termination block, it has been terminated. This control sets where SECRET cables (cables that carry SECRET information) may be terminated. The standard approach is an individual cabinet: a cabinet of their own that is not shared with non-SECRET cables. Small systems have one alternative. SECRET and non-SECRET cables may be terminated in the same cabinet, but only if a division plate sits between them, so every SECRET cable is on one side and every non-SECRET cable is on the other. This matters because cabinets are where people patch, unplug and rearrange cables. If SECRET and non-SECRET terminations are mixed together, a technician can easily plug a cable into the wrong panel or device. That one mistake could link a SECRET system to another network, spilling SECRET information where it should not go or opening an unauthorised path into the SECRET system. Keeping SECRET terminations physically apart makes them easy to identify and keeps routine work on other cabling away from them.
Free. Save your status, tasks and notes.
Why it matters
If SECRET cables are terminated among non-SECRET cables with nothing separating them, a single patching error or careless maintenance job can cross-connect them, spilling SECRET information onto another network or opening an unauthorised path into the SECRET system. Relying on a shared cabinet for a system that is not small also means the organisation does not meet this control.
How to implement
The ICT infrastructure manager should survey every cabinet where SECRET cables are terminated, using the patch schedules and a physical walk-through, and record whether each cabinet holds only SECRET terminations or a mix of SECRET and non-SECRET terminations (and, if mixed, whether a division plate separates them).
The system owner should decide, for each SECRET system, whether its cables will terminate in an individual cabinet or, only if the system is small, in a shared cabinet with a division plate, and record the reason the system is treated as small in its security documentation so the choice can be reviewed.
The cabling installer, directed by the ICT infrastructure team, should correct any non-compliant cabinet by re-terminating the SECRET cables on patch panels in an individual cabinet or, for a small system, by fitting a division plate positioned so that every SECRET cable terminates on one side and every non-SECRET cable on the other.
Project and design teams should show the termination cabinet, or the SECRET side of the division plate, on the cabinet layout drawings and in the cabling specification for any new or changed SECRET system, and have the installer confirm the as-built terminations match before the work is signed off.
The ICT security officer should add a cabinet check to the cabling change process so that, after every move, add or change, the technician confirms no non-SECRET cable has been terminated in an individual SECRET cabinet, any division plate is still fitted, and no cable sits on the wrong side of it.
Keep it running
Treat the individual SECRET cabinet, or the SECRET side of the division plate in a small system's shared cabinet, as the only place a SECRET cable may be terminated. Before any move, add or change, confirm where each SECRET cable will end, and do not terminate non-SECRET cables in an individual SECRET cabinet. After the work, check that any division plate is still fitted with every cable on its correct side, update the cabinet register, patch schedules and drawings, and fix any misplaced termination straight away. If a small system grows, reassess whether a shared cabinet with a division plate is still appropriate or whether its SECRET cables should move to an individual cabinet.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register or list of every cabinet where SECRET cables are terminated.
Look at
Check that each cabinet is recorded as either an individual SECRET cabinet or a small-system cabinet with a division plate, and that every SECRET system is covered.
Good evidence
Every SECRET cable termination is accounted for, and no cabinet holds SECRET and non-SECRET terminations without a division plate between them.
- Check 2 of 5What an auditor asks for
Ask for
Ask to physically inspect a sample of the individual cabinets used for SECRET cables.
Look at
Look at each patch panel and termination point inside and compare what you see with the patch schedule.
Good evidence
Only SECRET cables are terminated in each individual cabinet, and the cabinet contents match the register and patch schedule.
- Check 3 of 5What an auditor asks for
Ask for
Ask to inspect every cabinet where SECRET and non-SECRET cables are terminated together.
Look at
Check that a division plate is fitted and note which side of it each cable terminates on.
Good evidence
The division plate sits between all SECRET cables and all non-SECRET cables, with no cable terminated on, or crossing to, the wrong side.
- Check 4 of 5What an auditor asks for
Ask for
Ask how the organisation decided that each system using a shared cabinet with a division plate is a small system.
Look at
Look at the reasoning recorded for each shared cabinet and compare it with the current size of the system.
Good evidence
Each shared cabinet serves a system that can reasonably be called small, and larger SECRET systems terminate their cables in individual cabinets.
- Check 5 of 5What an auditor asks for
Ask for
Ask for recent cabling change records and the current cabinet layout drawings for SECRET systems.
Look at
Check whether each change recorded where the SECRET cables were terminated and whether the drawings were updated afterwards.
Good evidence
Changes and drawings consistently show SECRET cables terminated in individual cabinets or on the SECRET side of a division plate, and they match what is on site.
Mappings
Closest match in ISO/IEC 27001: A.7.1, Physical security perimeters, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.1.
ISM-1098 requires SECRET cabling to be terminated at cabinet boundaries (or separated by a division plate in small systems), limiting where classified cable runs can extend and where exposure can occur. This relates to Annex A 7.1 because defining and enforcing physical security perimeters commonly includes controlling how services (including cabling) traverse and terminate at the boundary of secure areas and equipment enclosures. ISM-1098 is a very specific, classified-cabling implementation detail, while Annex A 7.1 is broader and applies to physical perimeter controls for many asset types, not just cables or cabinets.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.