A.7.12 Cabling security: requirements and evidence

What A.7.12 cabling security asks your organization to prove

A.7.12 Cabling security asks you to show that cables carrying power, data and supporting information services are protected from interception, interference or damage. An auditor will not accept a general statement that the building is secure. They will want to see where the cables run, who can reach them, and what you did about the specific ways they can fail or be abused. The risks are concrete: someone tapping a data run in a riser or ceiling void, a cut or tampered cable that takes a system offline, electrical noise from power cables corrupting nearby communications, and a single damaged feed causing an outage that no one saw coming. Your job is to identify which of these matter for your sites and show that the controls match them.

This is hard in practice because cabling is rarely owned by the people who are accountable for information security. Facilities teams, building landlords and electrical or network contractors often install and alter cabling over the life of a site, and the result is seldom documented beyond what was needed to make it work. Start by asking for, or building, a current record of the cable routes between secure areas, comms rooms, data halls and entry points, including which cables are power, which carry data and which support services such as fire alarm or access control. Confirm with the building owner or landlord which parts of the infrastructure you control and which you only rely on, since that boundary determines what evidence you can produce yourself.

The ISO/IEC 27002 guidance on this control points toward a small set of practical measures, which you should explain in your own words in the ISMS: route cables through protected paths such as conduits or locked ducts where the risk warrants it, keep power cables separated from communications cables to reduce interference, and limit access to patch panels and distribution points. The test is whether these measures fit your risk assessment for each site. Ask your facilities provider to confirm in writing how cabling is inspected and who approves changes, and keep those inspection records as evidence. Where a cabling change is made without a record, treat it as a gap to close before the audit, not a detail to explain afterwards.

Which cabling, sites and third parties fall in scope for A.7.12

A.7.12 only holds up if the cabling it covers matches the ISMS scope statement and the Statement of Applicability. The cards below set out the boundary decisions an organization should document before an auditor asks where its cables run and who controls them.

Buildings and sites inside the boundary

Start by listing every building, floor and campus where information is processed and where cables carry that information. Each site that is in the ISMS scope needs its cabling treated under A.7.12, even if the site is small. Check whether cables run between in-scope and out-of-scope buildings, because a shared duct or an external fiber run can carry in-scope traffic outside the boundary you documented.

Data halls and comms rooms

Data halls, main distribution frames and telecommunications rooms are where cabling concentrates and where interception or damage has the greatest effect. Record each room, its patch panels and the riser routes that feed it. An auditor will expect these rooms to appear in the scope and to be linked to the secure areas controls in A.7.1 and A.7.2.

Office floors and workstation cabling

Office floors often hold the longest cable runs, running through ceilings, floor voids and wall cavities that employees and visiting contractors can reach. Decide whether these floors are inside the scope and, if so, how cables in public or shared areas are protected. Confirm whether floor boxes and wall outlets are included in your asset inventory.

Colocation and hosted cabling

In a colocation facility, the provider often owns the building, the cage access and some of the cabling trays. Your scope should state which cabling you own and operate inside the provider's space, and which parts you rely on the provider to protect. Obtain the provider's written responsibilities and the evidence it holds for its own controls, and confirm them before relying on them in your Statement of Applicability.

Building contractors and cabling owned by third parties

Landlords, building contractors and telecom carriers may install, own or maintain cabling that reaches your secure areas. Identify which of these cables are installed under contract, who owns the physical route, and who may access the conduits. Record these relationships in the supplier register and confirm that contract terms require the third party to meet your cabling protection requirements.

Links to secure areas and entry points

Cabling only protects information if the routes it takes are controlled. Map where cables enter and leave secure areas, and confirm that the entry points for these cables are covered by the perimeter and entry controls defined in A.7.1 and A.7.2. An auditor will often follow a cable from a server rack back to its entry point to test whether the boundary matches the scope statement.

How routing, separation and inspection protect cables in practice

An auditor testing A.7.12 Cabling security wants to see that the organization decided, in writing and on the basis of its own risk assessment, how power and data cables are kept out of reach of interception, interference and damage. The measures that usually carry this are cables routed through protected paths such as locked risers, dedicated conduits and enclosed trays, with the route recorded on the site plan. Where a cable leaves a secure area or runs through a shared space, the auditor will ask who decided the route and whether that decision matches the classification of the data it carries.

Separation is the measure auditors test most concretely. Power cabling should run apart from communications cabling, with crossings made at right angles and separators or barriers where the two must share a tray. Access to patch panels, distribution frames and junction points should be limited to authorized staff, and changes should go through a record. Inspection closes the loop: scheduled walk-downs look for crushed or exposed cable, unlabelled runs, unexpected splices and new equipment attached to a patch point. The organization should confirm the inspection interval, who signs the record and how findings reach the change process, because an auditor will ask for the last several records, not a policy statement.

Cabling also connects to A.7.8 Equipment siting and protection and A.7.11 Supporting utilities. A cable that is well shielded but feeds a site with a single power path still fails the organization in a utility outage, so power routing, redundancy and the testing of supporting utilities should be reviewed together. Before any of this is built or documented, the organization should confirm with its own assessor which cabling risks its risk assessment has actually recorded, since the justification for each measure is what the audit tests. A partner can prepare the routing drawings, separation checks and inspection records, but the organization owns the decisions and the auditor issues the outcome.

How an assessor tests A.7.12 cabling security

This table lists the usual assessor test activities for A.7.12, the evidence each one asks for, and the findings that most often appear. Read each row as a question the assessor will put to your facilities and IT teams, and prepare the named evidence before fieldwork starts.

Test activity	What the assessor checks	Evidence requested	Common findings
Walkthrough of cable routes	Follows power and data cabling from the building entry to rack or distribution points and confirms the routes match what is documented	Site walk notes, route description, photographs taken during the walk	Undocumented cable routes or spare cabling that nobody can trace to an owner
Review of conduit and tray drawings	Checks that drawings show separate paths for power and communications cabling and that they reflect the installed state	Current floor plans, cable tray and conduit layouts, dated revision history	Drawings out of date, or power and data mixed in one tray with no separation shown
Sampling of patch and distribution rooms	Inspects a sample of telecom rooms, patch panels and distribution points for access control and physical protection	Access list for each room, door logs or key registers, sample room photographs	Unlocked distribution points or cabinets, and rooms accessible to staff who do not need entry
Review of inspection records	Looks for periodic inspection of cabling for damage, tampering, unauthorized taps or interference sources	Dated inspection checklists, findings log, corrective action tickets	No inspection record exists, or records show no follow-up on defects found
Review of change records for new cabling	Confirms that new or altered cabling was planned, approved and recorded, including separation from power	Change tickets, installation records, updated drawings linked to each change	Cabling added during projects with no change record and no drawing update
Interviews with facilities staff	Tests whether the people who maintain the building know the rules for routing, separation and access	Interview notes, responsibilities matrix, training or briefing records	Facilities and IT teams give different answers about who owns a cable run

Implementing A.7.12 in five steps

This sequence turns cabling protection from an informal habit into a documented set of site risks, route records, routing rules, inspection routines and change history that an auditor can sample. Each step produces an artifact that the next step depends on.

Assess cabling risk for each site
Walk each site that houses information processing equipment and list the cabling runs that carry power, data or supporting information services. For each run, note what it connects, what information it carries, and which threats apply, such as interception on shared spaces, electrical interference, accidental damage during building work, or unauthorized tapping at distribution points. The people who should own this review are facilities staff and the security lead, with the system owners who know which links are critical. The step is done when every site has a written risk note that names the cabling in scope and the threats considered. Ask your assessor what level of detail they expect, because this note is the first document they will request.
Document cable routes and distribution points
Record where each in-scope cable runs, from the entry point through risers, ducts, cable trays and patch panels to the equipment it serves. Mark every distribution point, junction box and wall outlet that the cable passes through, and note which rooms and shared spaces it crosses. Facilities and network engineering usually hold fragments of this information, so reconcile drawings with a physical check. The output is a route register that lists each run, its endpoints, its distribution points and its access restrictions. Confirm the register matches the building as it stands today, not the original design drawings.
Define routing and separation rules
Write the standard that governs how new and existing cables are routed. The standard should state that power and communications cables are kept apart in conduits or trays, set minimum separation or shielding requirements that your electrical and cabling contractors can verify, and specify how cabling in shared or public areas is protected from interception and damage. It should also name who approves exceptions. Engineering, facilities and the security lead sign off on the standard. It is complete when a contractor could follow it without asking the security team what to do, and when each rule can be checked against the route register.
Set up inspection and change control
Create an inspection schedule that covers the in-scope routes, distribution points and enclosures, with a named owner for each inspection and a checklist that looks for damage, unauthorized taps, exposed cabling, unlabeled runs and separation breaches. Connect this to change control so that any new cable, patch, relocation or building work touching the routes must be requested, reviewed against the standard and approved before work starts. The schedule and change procedure are complete when they are approved, the owners have been trained on them, and the first inspection cycle is booked in the calendar.
Record outputs and keep the evidence trail
Keep every artifact current and link the records together: the risk note, the route register, the routing standard, the inspection schedule and the change log. Each inspection result and each approved change should update the route register and reference the change record. Store the records in a document or configuration system with version history and access control, so an auditor can see how the cabling looked at a given date and how it changed. The step is done when a reviewer can pick any cable run and trace it from the risk note through the route register to the most recent inspection and change entries. Ask your auditor which format they can sample from, and whether the evidence should come from an open-source ticketing or documentation system you host yourself.

Evidence that passes A.7.12 and how to keep it current

An assessor testing A.7.12 Cabling security looks for records that show where cables run, who can reach the distribution points, and whether anyone checks them over time. The cards below cover the core evidence set and the change process that keeps it accurate between audits.

Cabling route diagrams

Current drawings show where power and data cables run between rooms, risers, cabinets and external entry points, with the separation between the two types marked. Label each route with its cable type and the room it serves. An assessor compares these drawings against a physical walk, so check that patch panels, cable trays and entry points on the drawing match what is on the floor. Record the date of the last review and who approved the drawing.

Distribution room access logs

Distribution rooms and cable closets hold the points where cabling could be tapped or damaged, so access to them is a core piece of evidence. Keep a current authorized-person list and logs showing entry, exit and purpose for each visit. Review the logs regularly and reconcile them against the authorized list. Confirm with the site team how badge or key systems export these records and how long they are retained.

Separation standards and inspection reports

The written separation rule states how far power cabling must be kept from data and communications cabling, and where crossings are permitted. Inspection reports should record the date, the inspector, the areas covered and any deviation found, supported by dated photographs of trays and crossings. Confirm the separation distances against the cabling standards your organization adopts and the local electrical code, since this pillar does not set those figures.

Change tickets for new cabling

Every new run, move or removal of cabling should open a change ticket that records the requester, the route, the cable type, the approver and the test result. Attach the updated route diagram to the ticket so the drawing and the physical state move together. A ticket without a closing entry showing the drawing was updated is a common finding. Tie tickets to the asset inventory so that new cabling is traceable.

Remediation records

When an inspection finds exposed cabling, a damaged tray or a power and data crossing outside the rule, the finding needs an owner, a due date and a closing record. Keep the original finding, the corrective action, the verification photograph and the date it was closed. Assessors often sample open findings from earlier inspections, so an unresolved item with no owner weakens the whole evidence set.

Change management as the upkeep process

Between audits, evidence stays current only when cabling changes pass through the same change process as other infrastructure work. Require that any change to a route, distribution room or cable type triggers a review of the diagram, the access list and the inspection schedule. Confirm with your certification body how often they expect records to be sampled in your scope, and set internal review dates that cover that interval.

What meeting A.7.12 costs in money and effort

This table breaks down the cost and effort components of meeting A.7.12 Cabling security, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. No figures are given because none were supplied, so use the last column to request itemized quotes before approving work.

Cost component	One-time or recurring, and who is paid	What drives cost up or down, and what to ask for in a quote
Physical survey and documentation	One-time. Internal staff or an implementation partner, plus facilities staff who walk the routes.	Up: number of buildings, floors, risers and undocumented legacy runs. Down: existing accurate floor plans. Ask for a deliverable list (route maps, power and data separation records, cable register) and the hours assumed.
Conduit and tray works	One-time. Electrical and structured cabling contractors, priced per job.	Up: new trenching, fire-rated penetrations, rerouting to separate power from data cabling, and work outside business hours. Down: reusing existing containment. Ask for an itemized quote per route, separating materials, labor, testing and permits.
Separation and routing changes	One-time. Contractor for re-termination or relocation; internal staff for approval.	Up: mixed power and data bundles in shared trays, and cabling crossing critical areas. Down: a clear segregation design agreed before work starts. Ask whether the quote includes re-testing after moves.
Inspection labor	Recurring. Internal facilities or security staff, or a contractor on a periodic schedule.	Up: large estates, inaccessible ceilings and floors, and frequent moves or changes. Down: a fixed inspection checklist and a schedule tied to change tickets. Ask for the inspection frequency the organization sets and the records each visit produces.
Evidence upkeep	Recurring. Internal GRC or IT staff, or implementation partner support.	Up: manual photos, spreadsheets and inconsistent naming. Down: a single cable register and dated inspection records linked to change tickets. Ask what format the evidence will be in and who keeps it current.
External review (optional)	Optional, recurring or one-time. Independent inspector or a readiness reviewer; this is not the certification audit.	Up: scope of the review and the number of sites. Down: limiting it to high-risk areas. Ask for a written scope, the reviewer's independence statement and whether findings are delivered as a list you own.
Auditor sampling time	Certification cost. Paid to the accredited certification body that performs the audit.	Up: number of sites sampled and how many cabling records the auditor requests. Down: a current register and ready walkthrough evidence. Ask the certification body how it plans sampling and what it will request before the audit.

Who owns cabling security, who helps and who audits it

The organization owns A.7.12. Facilities, IT and the information security owner share the work: facilities controls physical routing, conduits and access to cable rooms, IT owns the network and power designs that depend on those cables, and the security owner decides what the control must protect and records that decision in the Statement of Applicability. Ownership does not transfer to a consultant or vendor, even when they do much of the documentation.

Decide the protection standard: Set which cable runs carry sensitive data or critical power and what protection each one needs, and approve it in writing.
Own routing and maintenance: Facilities keeps cable routes, conduit records and inspection schedules current, and acts on defects found in inspections.
Control access to cabling spaces: Manage keys, badges and logs for patch panels, risers and distribution rooms in line with the related physical entry controls.
Approve changes: Route new cable work through change management so that every new run is checked against the design before it goes live.
Keep the Statement of Applicability accurate: State how A.7.12 is applied at each site and name the person accountable for it.

Before an audit, confirm that each named owner can show the records for their part without help from an outside party.

Where organizations fall short on cabling security

Cabling problems rarely come from a missing policy. They come from cables nobody mapped, spaces shared with third parties, and changes made without a record. Each gap below weakens the protection A.7.12 expects against interception, interference and damage, and each one has a check an assessor can verify.

Undocumented cabling in older buildings

Legacy floors, risers and ceiling voids often hold cables installed decades ago by contractors whose drawings were never filed. Nobody can say which runs carry power, which carry data, or where they terminate. Assessors ask for a current route map and will test whether it matches what they see. Check that every cable path into a secure area appears on a drawing that someone reviews at least once a year, and that a walkdown confirms it. Start by tracing one riser end to end.

Colocation cabling outside the contract

In colocation and hosting facilities, the provider often controls the building and the cross-connect infrastructure, while the customer assumes the cabling is protected. If the contract does not state who maintains, inspects and restricts access to the cabling between cages, racks and carrier demarcations, the gap belongs to nobody. Ask the provider for its cabling security responsibilities in writing and for evidence of its inspection records. Confirm the contract names those duties before you rely on them for A.7.12.

Power and data sharing trays

When power and communications cables share a tray, conduit or duct without separation, electrical noise can interfere with data signals and a single fault can disrupt both. Shared trays also let an untrained contractor reach data cabling while working on power. Review each cable route for crossings and parallel runs where separation was not designed in. Record where separation is maintained and where a documented exception has been approved, so the auditor can follow the reasoning.

No scheduled inspection cycle

Cabling is often inspected only after an outage, so damage such as crushed runs, water ingress, rodent damage or loose terminations goes unseen for long periods. A.7.12 expects protection to be maintained, which a documented inspection cycle demonstrates. Set a recurring inspection with a named owner, a checklist covering routes, labels and enclosures, and a log of findings and fixes. Ask whether the last inspection produced a record an assessor could sample.

Cable changes outside change management

Adding a patch cable, moving a power feed or re-terminating a fiber run can look too small for a change request, so these tasks are done directly by facilities or network staff. The result is cabling that no longer matches the documented state, and sometimes exposed or unlabeled runs. Require that every physical cabling change follows the same approval, implementation and closure steps as system changes, with the route map updated at closure. Sample recent changes and confirm each one has a ticket and a matching drawing revision.

Questions buyers ask about A.7.12 cost, effort and outsourcing

How much effort does A.7.12 cabling security take to implement?

The effort depends mostly on how many sites, server rooms and communications closets your organization runs, and how much of the cabling is already documented. A.7.12 asks that power, data and supporting information service cables are protected from interception, interference and damage, so the work has three parts: mapping where cables run, deciding how they are routed and separated, and setting up a recurring inspection. Effort rises with the number of rooms, the age of the building, the amount of undocumented cabling and any shared cable paths with tenants or other occupants. Ask any partner to size the work from a site inventory and a written scope rather than a general estimate.

Can we meet A.7.12 with our own staff instead of an implementation partner?

Yes, in many organizations facilities and network teams can do this work in-house, because the control is largely about physical routing, separation and inspection records. The skills that matter are knowing which cables carry power and which carry data, understanding interference risks, and keeping drawings current. An outside partner is most useful when the team lacks time, when documentation is missing, or when the evidence must be prepared for an assessment. Whatever you choose, the organization keeps ownership of the control and its records. Independent auditors, not consultants, decide whether the control is met.

What does an auditor sample when testing A.7.12?

An auditor typically walks the premises with you, then samples locations and records rather than checking every cable. Expect requests for current cabling diagrams, evidence that power and communications cables are routed and separated as your design states, records of inspections, and the corrective actions taken after any damage or interference was found. Auditors may also ask how access to cable routes, patch panels and distribution points is restricted. Confirm the exact sampling approach with your certification body before the audit, since it is their method, not ours to predict.

Can a colocation or data center provider cover A.7.12 for us?

Partly. A colocation provider usually controls the building, the shared cable trays and the power distribution, so their own controls may cover parts of the requirement for their facility. Your organization still needs to show how cables inside your cage, racks and any leased space are protected and inspected. Ask the provider for their current independent assurance report or certificate, the scope it covers, and whether it includes cabling and utilities. Then map what is covered and what remains your responsibility, and record that split in your Statement of Applicability.

What should we ask an implementation partner before agreeing to help with A.7.12?

Start with a written scope that lists sites, rooms, cable types and the evidence you expect to receive. Ask who performs the cabling survey, who owns the drawings after handover, and how inspection records will be stored. Ask whether the partner prepares evidence only or also changes physical infrastructure, and who pays for contractor work. Confirm that the partner does not issue audit reports or certificates, and ask how they will support your certification body's questions. Request the deliverables, timeline and acceptance criteria in writing before work starts.

What drives the cost of A.7.12, and what is one-time versus recurring?

Costs fall into three groups: one-time work such as surveys, drawings, rerouting or conduit installation, recurring inspection and maintenance, and the assessment itself, which is paid to the certification body. Physical work is the largest variable and depends on site size, cable density and how much rerouting is needed. Inspections recur on a schedule you set, and their cost depends on frequency and who performs them. When requesting a quote, ask for each component separately, and for the assumptions behind the site count and inspection frequency. We do not publish prices, and the figure follows from the written scope.

Does A.7.12 need documented evidence beyond the cabling diagrams?

Yes. Diagrams show the design, but an auditor also looks for proof that the design is in place and maintained. Useful evidence includes dated inspection reports, change records for cable work, photographs or survey logs, damage and interference incident records, and approvals for changes to routes or shared conduits. Keep these records linked to the asset inventory and the risk assessment that justified your choices. Confirm the exact evidence expectations with your certification body, since they set the bar for what they will accept.

Where self-hosted open-source tools fit for cabling records

Cabling security is physical, but an auditor tests it mostly through documents and records, so the practical question is where those records live and who keeps them current. A self-hosted open-source asset or documentation tool, deployed inside the organization's own network, can hold the cabling register and the inspection history that show A.7.12 is operating. The tool does not make the cabling secure. It makes the routing, the separation of power and communications runs, and the inspection results visible and dated, so the organization can show what it checked and when.

Start with the records an assessor will ask for. Keep a register of each cable run with its type (power, data or supporting information service), its origin and destination, its route through conduits or trays, the rooms or sites it crosses, and the owner of the run. Add the drawings or floor plans that show where power and communications cables are separated, the inspection log with dates, findings and corrective actions, and the change records for any cable added, moved or removed. Access to the register should itself be restricted and logged, because a complete map of cable routes is sensitive information. Confirm with your auditor how they expect the register and inspection log to be dated and approved.

Before you deploy anything, confirm the license terms of each candidate tool, including whether your use case, number of users and any hosted add-ons are permitted, and whether the vendor or community supports the version you plan to run. Plan who maintains the data after go-live, since a register that is not updated after every change is weaker evidence than no register at all. An implementation partner can configure the tool, the record templates and the access model inside your infrastructure. The organization still owns the cabling, the inspections and the decisions, and only the independent certification body can issue the certificate.

How DeployOpen prepares cabling evidence for A.7.12

DeployOpen plans and implements the technical and documentary side of A.7.12 Cabling security inside your own facilities and networks. The organization keeps ownership of its controls, and an independent certification body decides whether the control is met.

How we scope

Agree in writing which buildings, rooms, risers and cable routes fall within the A.7.12 scope before work starts
Confirm which power and communications cabling carries information services that the ISMS must protect
Record the inspection cadence, owners and responsibilities your team will keep after handover
Engagements are fixed-scope, with deliverables and timelines agreed in writing; ongoing support is available as a retainer

How we build

Document cable routing standards that separate power cabling from data and communications cabling
Specify protected conduits, trunking and access-restricted distribution points for in-scope cabling
Set up asset records for patch panels, cabinets and cable runs so changes leave a traceable history
Configure monitoring or alerting for unexpected cable disconnections where your environment supports it, and confirm this with your vendors

How we hand over

Deliver a cabling diagram, routing policy and inspection checklist mapped to the A.7.12 control attributes
Provide inspection and change records templates that an auditor can sample during the assessment
Walk your team through evidence collection so they can produce records without outside help
Keep all documents in your own repositories and infrastructure, not in a DeployOpen-hosted system

How we support

Review cabling changes and new site work against the documented routing and separation rules
Update diagrams and inspection records when infrastructure changes, on a retainer if you want continuous support
Prepare your evidence pack for the certification body, while the auditor independently tests the control
Ask us to confirm the exact deliverables, review points and handover format in your written scope