ISO 27001 Annex A 7.12 Secure cabling for power and data
What it says
Cables carrying power, data or supporting information services shall be protected from interception, interference or damage.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure cables are protected from interception, damage, or interference to prevent security risks.
Cables carry important information, like power and internet, around your business. If these cables aren't protected, someone could tap into them, causing data breaches or downtime that might stop your business operations. That's why it's essential to secure them against damage or interception.
Free. Save your status, tasks and notes.
Why it matters
Unprotected power or data cabling can be tapped, disrupted by EMI, or physically damaged, causing data compromise and outages to critical information services.
How to implement
IT Manager should ensure that all power and data cables entering the building are underground when possible.
If that isn't feasible, use protective coverings like floor cable protectors or place them on utility poles to safeguard against physical damage.
Facilities Manager should separate power cables from communication cables within the building.
Running them in separate, distinct pathways prevents interference that might disrupt communication services.
Security Officer should install protective measures for sensitive cables, such as armoured conduits and locking mechanisms on rooms or boxes.
This can include using fibre-optic cables for critical data and setting up alarms at key points to deter and detect tampering.
Office Manager should arrange for clear labelling of all cables with information about their source and destination.
This makes it easier to track and inspect them if needed and ensure proper maintenance.
IT Support should conduct regular checks for any unauthorised attachments or tampering with the cables.
This includes inspection of patch panels and cable rooms, ensuring that access is strictly controlled and monitored.
Keep it running
Inspect and protect cable routes using secure conduits/trunking, segregate power and data, label and restrict access to risers/patch panels, and check for tampering and EMI sources.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the building infrastructure plan showing cabling routes.
Look at
Verify that power and communication cables are either underground or have other protective measures.
- Check 2 of 5What an auditor asks for
Ask for
Request documentation detailing the separation of power and data cables.
Look at
Check for evidence that power and data cables run separately along different paths.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of inspections and checks for unauthorised devices.
Look at
Review how regularly inspections are conducted and any findings noted.
- Check 4 of 5What an auditor asks for
Ask for
Request the access logs for cable rooms and patch panels.
Look at
Examine who accessed these critical areas and whether access was limited to authorised personnel.
- Check 5 of 5What an auditor asks for
Ask for
Ask for a demonstration of the cable labelling system used.
Look at
Check that all cables are clearly labelled with source and destination information.
Mappings
Closest match in ASD Information Security Manual: ISM-0187, Exclusive SECRET cable bundling in infrastructure, which this control covers in full and more.
ASD Information Security Manual: 33 mappings
This control is broader than ISM-0187.
ISM-0187 requires SECRET cables, when bundled together or run in conduit, to be run exclusively in their own individual cable bundle or conduit to reduce the risk of compromise. This relates directly to Annex A 7.12, which requires protection of power and data cabling from interception, interference or damage, and segregated routing/conduits are a common protective method. ISM-0187 is a specific, classification-driven implementation detail (SECRET-only segregation), whereas Annex A 7.12 is broader and applies to cabling generally and allows multiple alternative protections.
This control is broader than ISM-0195.
ISM-0195 requires the use of uniquely identifiable SCEC-approved tamper-evident seals to secure all removable covers on TOP SECRET cable reticulation systems in shared facilities to deter and detect tampering. This directly maps to ISO/IEC 27001:2022 Annex A 7.12, which requires organisations to protect power and data cabling from interception, interference or damage. ISM-0195 is a specific, classified-environment implementation (tamper-evident sealing of cable covers) of the broader cabling protection objective in Annex A 7.12.
This control is broader than ISM-0206.
ISM-0206 requires organisations to develop, implement and maintain cable labelling processes and supporting procedures so cables can be reliably identified and managed. This supports ISO/IEC 27001:2022 Annex A 7.12 by improving the ability to protect power and data cabling from interception, interference, or damage through clearer identification of cable purpose, endpoints, and routing. Annex A 7.12 focuses on physical protection measures, while ISM-0206 focuses on procedural labelling discipline that makes those protections easier to apply and verify.
This control is broader than ISM-0926.
ISM-0926 requires that non-classified, OFFICIAL: Sensitive and PROTECTED cables are not coloured salmon pink or red, to avoid misidentification of cable sensitivity/classification. This relates to Annex A 7.12 because consistent cabling identification is one practical measure that can support protecting cables from interception, interference or damage by ensuring handling and routing decisions are appropriate. However, Annex A 7.12 is broader and focuses on physical protection outcomes for cabling, while ISM-0926 is a very specific colour-standard requirement.
This control is broader than ISM-1095.
Annex A 7.12 requires organisations to protect cables and supporting information services from interception, interference or damage. ISM-1095 requires wall outlet boxes to denote systems and identifiers, which supports Annex A 7.12 by enabling accurate identification during inspection, maintenance and incident response to prevent mispatching and reduce the risk of accidental damage. The candidate is about labelling/traceability rather than providing direct physical protection measures (e.g. conduit, shielding, separation).
This control is broader than ISM-1100.
ISM-1100 requires TOP SECRET cables to be terminated only within an individual TOP SECRET cabinet, which specifies a precise location for high-classification cable terminations. ISO/IEC 27001:2022 Annex A 7.12 covers the protection of power and data cabling against interception, interference, or damage, by securing routes and termination points like comms cabinets. ISM-1100 is a specific, prescriptive requirement for a particular cabling classification, whereas Annex A 7.12 is broader and risk-based, covering all relevant environments.
This control is broader than ISM-1101.
ISM-1101 requires that, in TOP SECRET areas, cable reticulation systems entering cabinets in server/communications rooms are terminated as close as possible to the cabinet to reduce exposure and tampering opportunities. ISO/IEC 27001:2022 Annex A 7.12 requires organisations to protect power and data cabling from interception, interference or damage, which includes physical routing and termination practices. ISM-1101 is a specific high-assurance physical implementation for secure areas, while Annex A 7.12 is broader and applies across environments and cabling threats.
This control is broader than ISM-1102.
Annex A 7.12 requires organisations to protect cables carrying power or data from interception, interference or damage. ISM-1102 reduces exposure and opportunities for interference or physical tampering by requiring cable reticulation to be terminated as close as possible to the cabinet. Annex A 7.12 remains broader as it also covers protections along cable routes (e.g. segregation, shielding, inspection) beyond the cabinet interface.
This control is broader than ISM-1103.
ISM-1103 requires that, in TOP SECRET areas, cable reticulation systems leading into cabinets (outside server/communications rooms) are terminated at the cabinet boundary to reduce exposure of cabling within less-controlled spaces. This relates directly to ISO/IEC 27001:2022 Annex A 7.12, which requires organisations to protect power and data cabling from interception, interference, or damage. ISM-1103 is a very specific physical cabling implementation for a particular classification and room context, whereas Annex A 7.12 is broader and technology-agnostic across the organisation.
This control is broader than ISM-1105.
ISM-1105 requires SECRET and TOP SECRET wall outlet boxes to contain exclusively SECRET or TOP SECRET cables. Keeping highly classified cabling segregated from lower classified cabling at outlets reduces the risk of interception, interference and misconnection, which is a specific cabling protection within Annex A 7.12. Annex A 7.12 covers protection of all power and data cabling, whereas ISM-1105 addresses segregation at wall outlet boxes.
This control is broader than ISM-1111.
ISM-1111 requires organisations to use fibre-optic cables instead of copper for cabling infrastructure to reduce security and performance risks inherent in copper. ISO/IEC 27001:2022 Annex A 7.12 requires that all power and data cabling be protected from interception, interference, or damage, which includes selecting appropriate cable types and applying physical protections. ISM-1111 is a specific implementation choice (fibre over copper), while Annex A 7.12 is broader and technology-agnostic, covering any cabling and the wider set of protection measures.
This control is broader than ISM-1112.
ISM-1112 requires cables in non-TOP SECRET areas to be physically inspectable at intervals of five metres or less to support routine security checks. ISO/IEC 27001:2022 Annex A 7.12 requires power and data cabling to be protected from interception, interference or damage, which can be achieved through a range of physical and procedural measures including routing, shielding, conduit, and inspection regimes. ISM-1112 is a prescriptive physical-installation requirement focused on inspectability frequency, whereas Annex A 7.12 is broader and outcome-focused on protecting cabling against multiple threat types.
This control is broader than ISM-1114.
ISM-1114 requires cable bundles or conduits in a shared cable reticulation system to be physically separated by a dividing partition or visible gap. This relates directly to ISO/IEC 27001:2022 Annex A 7.12, which requires power/data cabling to be protected from interception, interference or damage, and physical separation is a common protective method to reduce interference and accidental damage. Annex A 7.12 is broader because it covers a range of cabling protections (e.g. routing, shielding, access restriction) beyond the specific separation/partitioning requirement in ISM-1114.
This control is broader than ISM-1115.
Annex A 7.12 requires organisations to protect power and data cabling from interception, interference, and damage across their environments. ISM-1115 specifies a particular protective method by requiring cables from cable trays to wall outlet boxes to be run in flexible or plastic conduit, reducing physical access and accidental damage. ISM-1115 is an implementation-level subset of Annex A 7.12 and does not cover all cabling routes or other protections (e.g. monitoring, restricted spaces).
This control is broader than ISM-1119.
ISM-1119 requires that cables in TOP SECRET areas are fully inspectable for their entire length to enable detection of tampering or compromise. Annex A 7.12 requires power and data cabling to be protected from interception, interference or damage, which includes physical security measures such as routing, shielding, segregation and inspection regimes. ISM-1119 is a specific physical implementation expectation (inspectability in a highest-classification area), while Annex A 7.12 is broader and applies across environments and threat types beyond inspectability alone.
This control is broader than ISM-1122.
Annex A 7.12 requires that power and data cabling is protected from interception, interference or damage. ISM-1122 specifies a particular method for protecting TOP SECRET cabling at wall penetrations into lower classified areas by using conduit and sealing gaps, which is one concrete way to reduce tampering and signal compromise risks. Annex A 7.12 is broader because it applies to all relevant cabling and threat types, not only TOP SECRET wall exits.
This control is broader than ISM-1130.
ISM-1130 requires that, in shared facilities, cables are run in an enclosed cable reticulation system to reduce the risk of tampering or interference. This directly relates to Annex A 7.12, which requires protection of power and data cabling from interception, interference or damage, and an enclosed reticulation system is a common physical method to achieve that protection. Annex A 7.12 is broader because it applies generally (not only shared facilities) and allows multiple protection approaches beyond enclosed pathways.
This control is broader than ISM-1133.
ISM-1133 requires that, in shared facilities, TOP SECRET cables are not run in party (shared) walls to reduce the risk of compromise from adjacent tenancies or spaces. ISO/IEC 27001:2022 Annex A 7.12 requires organisations to protect power and data cabling from interception, interference or damage, which includes selecting secure routes and containment. ISM-1133 is a specific routing prohibition for a high classification scenario, while Annex A 7.12 is broader and technology-agnostic about how cabling is protected.
This control is broader than ISM-1164.
ISM-1164 requires that, in shared facilities, cable conduits/duct front covers, floor and ceiling cable trays, and associated fittings are made of clear plastic so cabling remains visible for inspection. This directly contributes to ISO/IEC 27001:2022 Annex A 7.12 by making interference (e.g. unauthorised splices, taps, re-routing) more likely to be noticed and therefore helping protect cabling from interception, interference or damage. Annex A 7.12 is broader because it requires cabling protection outcomes (including routing, segregation, shielding, and physical protection methods), whereas ISM-1164 specifies one particular tamper-visibility construction approach for shared areas.
This control is broader than ISM-1640.
ISM-1640 requires cables for foreign systems installed in Australian facilities to be labelled at defined inspection points so personnel can reliably identify which physical links relate to foreign systems. This supports ISO/IEC 27001:2022 Annex A 7.12 because effective protection of power/data cabling from interception, interference, or damage depends on being able to accurately identify, trace, and verify the correct cables during inspections, segregation, and maintenance. The primary focus differs: Annex A 7.12 is about protecting cabling from harm and compromise, whereas ISM-1640 is a specific identification/assurance mechanism that helps those protections be correctly applied to the right cabling.
This control is broader than ISM-1718.
ISM-1718 mandates that SECRET cables are identified by a distinctive salmon pink colour. This closely relates to Annex A 7.12, which encompasses broader protection measures for cabling against interception, interference, or damage. While Annex A 7.12 has a broader scope, ISM-1718 specifies a clear identification method to aid in secure handling and management of classified cabling.
This control is broader than ISM-1719.
ISM-1719 requires TOP SECRET cables to be coloured red so they can be rapidly and reliably identified as highly sensitive cabling. This supports Annex A 7.12 because clear visual identification assists correct physical handling and routing (e.g. segregation, heightened protection, prompt detection of misplacement), which reduces the likelihood of inadvertent exposure, interference or damage to sensitive cabling. Annex A 7.12 is about protecting cabling from interception/interference/damage overall, while ISM-1719 is a specific identification mechanism for one classification level rather than a complete cabling protection control.
This control is broader than ISM-1720.
ISM-1720 requires wall outlet boxes for SECRET systems to be coloured salmon pink so that the classification of each connection point is immediately visible. This supports the protection of data cabling required by Annex A 7.12, because clearly identifiable outlets reduce the risk of accidental cross-patching or unauthorised connection that could lead to interception of or interference with classified data. Annex A 7.12 covers the protection of all power, data and supporting service cabling from interception, interference or damage, while ISM-1720 addresses only the colour marking of outlets for one classification.
This control is broader than ISM-1721.
ISM-1721 requires wall outlet boxes for TOP SECRET systems to be coloured red so that the classification of each connection point is immediately visible. This supports the protection of data cabling required by Annex A 7.12, because clearly identifiable outlets reduce the risk of accidental cross-patching or unauthorised connection that could lead to interception of or interference with classified data. Annex A 7.12 covers the protection of all power, data and supporting service cabling from interception, interference or damage, while ISM-1721 addresses only the colour marking of outlets for one classification.
This control is broader than ISM-1821.
ISM-1821 requires TOP SECRET cables to be bundled or run in conduit exclusively (i.e., not sharing bundles/conduit with other cables) to reduce the risk of compromise. Annex A 7.12 requires cables carrying power or data to be protected from interception, interference or damage, which can include physical segregation, shielding and routing controls. ISM-1821 is a specific, classification-driven implementation of secure cabling (exclusive bundling) whereas Annex A 7.12 is broader and applies to cabling generally across environments and classifications.
This control partially meets ISM-1096.
Annex A 7.12 requires cabling to be protected from interception, interference, or damage, which includes being able to verify cabling integrity and detect unauthorised changes. ISM-1096 requires cables to be labelled at each end with sufficient source/destination details to enable physical identification and inspection, supporting detection of mispatching, rogue connections, or unauthorised rerouting. Labelling is one control mechanism within Annex A 7.12's broader expectation of physical protection and tamper resistance.
This control partially overlaps ISM-0213.
ISM-0213 mandates that SECRET and TOP SECRET cables be terminated on individual patch panels to prevent cross-connection and mitigation of information compromise between classifications. Similarly, ISO/IEC 27001:2022 Annex A 7.12 requires secure cabling controls to protect against interception, interference, or damage, aligning with these aims. While A 7.12 focuses on general cable protection measures, ISM-0213 addresses classification-based segregation at patch panel terminations.
This control partially overlaps ISM-0250.
ISM-0250 requires IT equipment to comply with electromagnetic interference/electromagnetic compatibility (EMI/EMC) standards to prevent interference. ISO/IEC 27001:2022 Annex A 7.12 requires power and data cabling to be protected from interception, interference or damage, which includes mitigating electromagnetic interference affecting communications. Annex A 7.12 focuses on cabling protection controls, while ISM-0250 focuses on the compliance of the equipment itself to EMI/EMC standards.
This control partially overlaps ISM-1639.
Annex A 7.12 requires protection of cabling from interference or damage and seeks to reduce opportunities for unauthorised interaction with cable infrastructure. ISM-1639 requires building management cables to be clearly labelled at defined intervals, improving identification and maintenance handling, which can reduce accidental damage and misconnections. ISM-1639 is limited to building management cabling and focuses on identification rather than broader interception/tamper protections expected under Annex A 7.12.
This control partially overlaps ISM-1884.
ISM-1884 requires compliance with ASD emanation security doctrine for the management of emanation security matters. Emanation security includes protecting cabling against the interception of compromising emanations, which overlaps with the Annex A 7.12 requirement to protect cables from interception and interference. ISM-1884 extends to emanations from all equipment, whereas Annex A 7.12 also covers physical damage to power and data cables.
This control supports ISM-0181.
Annex A 7.12 requires cables carrying power or data to be protected from interception, interference, or damage. ISM-0181 requires cabling infrastructure to be installed in accordance with relevant Australian Standards, which generally promotes safe, robust installation practices that reduce damage and inadvertent interference. However, standards-based installation does not necessarily address security-specific threats like deliberate interception, so ISM-0181 supports but does not fully satisfy Annex A 7.12.
This control depends on ISM-1646.
ISM-1646 requires floor plan diagrams to record cable paths (including ingress and egress points between floors), reticulation and conduit paths, floor concentration boxes, wall outlet boxes and network cabinets. This documentation supports Annex A 7.12 by showing exactly where cabling runs and where it is exposed, so protection against interception, interference or damage can be applied and inspected. Annex A 7.12 requires the protection itself, while ISM-1646 only requires the cabling to be documented.
This control depends on ISM-1820.
ISM-1820 requires cables for individual systems to use a consistent colour so they can be readily identified. Consistent colouring supports Annex A 7.12 by making it easier to inspect cabling, detect unauthorised or incorrect connections and avoid interference between systems, which contributes to protecting cables from interception, interference or damage. Annex A 7.12 addresses the full protection of power and data cabling, whereas ISM-1820 covers only cable identification by colour.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.