All 93 controls · Physical controls
Control 7.12
Cabling security
What ISO/IEC 27002:2022 control 7.12 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Cables that carry power, data or supporting information services are to be protected from interception, interference and damage. Purpose: keep cabling problems from causing information or assets to be lost, stolen, harmed or compromised, or from halting operations. Guidance: consider running power and telecommunications lines into processing facilities underground where possible, or otherwise protecting them adequately (for example floor cable protectors or poles), and shielding buried cables from accidental cuts with armoured conduit or markers; keeping power and communications cables apart to prevent interference; and labelling each end of every cable with enough source and destination detail for it to be physically identified and inspected. For sensitive or critical systems, consider armoured conduit, and locked, alarmed rooms or enclosures wherever cables can be inspected or terminate, electromagnetic shielding, periodic technical sweeps and physical inspections to find unauthorized devices attached to cables, access control on patch panels and cable rooms using keys or PINs, and fibre-optic cabling. Seek specialist advice on managing risks from cabling incidents or faults. Other information: co-located premises sometimes share power and telecommunications cabling between organizations.
Purpose in the standard’s terms, in our words: Prevents loss, compromise or interruption of operations arising from power and communications cabling.
Attribute values in one line: Preventive; Confidentiality, Availability; Protect; Physical security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Cabling diagrams showing routes, protection (underground, conduit, protectors) and separation of power from data
- Cable labelling at both ends matching the cabling records
- Access control records for patch panels, risers and cable rooms
- Records of physical inspections and technical sweeps that look for unauthorized devices tapping the cables of sensitive systems
- Specifications showing armoured conduit, shielding or fibre used for critical systems
- Specialist advice or assessments on cabling risks, including for shared cabling in co-located premises
Where audits commonly find gaps
- Patch panels sit in unlocked cupboards in public corridors
- Cables are unlabelled, so unauthorized connections cannot be spotted
- Power and data run together, causing interference
- Shared cabling with other tenants is not assessed
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (11.2.3) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.