ASD ISM 1103 Terminate cables outside cabinets in secure areas
What it says
In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIn top secret areas, cables must end at the cabinet's edge unless in server or communications rooms.
In areas where top-secret information is handled, it's crucial that cables are managed carefully. This control means that if the cables aren't within a server or communications room, they should be stopped right at the cabinet's edge to avoid security risks. If this isn't done, sensitive information could be tapped or intercepted by unauthorised parties, which could lead to data breaches and serious consequences for your organisation.
Free. Save your status, tasks and notes.
Why it matters
If cables are not terminated at the cabinet boundary in TOP SECRET areas, tapping or rerouting within the reticulation can expose TOP SECRET data and enable unauthorised access.
How to implement
IT team should inspect existing installations: Review all the cable installations in areas dealing with top-secret information.
Check where the cables are terminated and ensure they stop at the cabinet's boundary if they are outside of server or communications rooms.
Facilities manager should plan with IT staff: Collaborate to design cabling plans that meet this control during renovations or new installations.
Ensure that new cables are routed into cabinets only through permitted areas.
Security officer should verify cable routes: Conduct regular checks on the physical pathways of cables leading into cabinets.
Use diagrams or walk-throughs to ensure they comply with the control requirements.
IT team should document cabling compliance: Keep a detailed log of where cables are terminated in secure areas.
This document should be periodically reviewed and updated to reflect changes or upgrades.
Training coordinator should educate staff: Provide training sessions for staff involved in cable management about the importance of this control and its compliance requirements.
Use real-world examples to illustrate potential risks of non-compliance.
Keep it running
Inspect TOP SECRET secure areas to confirm reticulation cables are terminated at the cabinet boundary for cabinets outside server/comms rooms, and rectify any cable runs entering cabinets un-terminated.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Cabling diagrams and termination logs: Request up-to-date layouts of cable installations in relevant secure areas.
Look at
Where the diagrams indicate cable termination points.
Good evidence
Shows all cables ending at cabinet boundaries in non-server locations.
- Check 2 of 5What an auditor asks for
Ask for
To see recent inspection reports: Request records of the most recent physical inspection conducted by security or IT staff.
Look at
The findings and any corrective actions taken.
Good evidence
Includes identified issues and clear resolution steps.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records: Request documentation of training sessions conducted on this control.
Look at
Attendance records and session content.
Good evidence
Shows comprehensive details of training with high participation rates.
- Check 4 of 5What an auditor asks for
Ask for
To review change management records: Request records of changes made to cable systems in secure areas.
Look at
Authorisations and justifications for changes.
Good evidence
Contains authorised signatures and clear compliance considerations.
- Check 5 of 5What an auditor asks for
Ask for
Compliance review schedules: Request information on the scheduled and completed compliance reviews.
Look at
Consistency and frequency of these reviews.
Good evidence
Includes regular review dates and prompt corrective actions if needed.
Mappings
Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.6.
ISM-1103 mandates a specific physical security measure for TOP SECRET secure areas: terminating cabling at the cabinet boundary when cabinets are not in server or communications rooms. This maps to ISO/IEC 27001:2022 Annex A 7.6 because it is one concrete security measure that can be designed and implemented for working/operating in secure areas. Annex A 7.6 covers a broader set of secure-area measures (procedural and physical), while ISM-1103 focuses narrowly on cabling termination to reduce tampering and interception risk.
This control partially meets A.7.12.
ISM-1103 requires that, in TOP SECRET areas, cable reticulation systems leading into cabinets (outside server/communications rooms) are terminated at the cabinet boundary to reduce exposure of cabling within less-controlled spaces. This relates directly to ISO/IEC 27001:2022 Annex A 7.12, which requires organisations to protect power and data cabling from interception, interference, or damage. ISM-1103 is a very specific physical cabling implementation for a particular classification and room context, whereas Annex A 7.12 is broader and technology-agnostic across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.