Most modern technologies would not function properly without cables such as fibre, network, or power cables.
While cables are essential to the transmission of information assets, and to the provision of information services, they expose risks to the availability and confidentiality of information assets and also to continuity of business operations.
These risks may arise from damage to, interception, or interference with these cables. Furthermore, personnel with access to these cables may accidentally cause damage.
For example, cyber criminals with access to fibre cables can use simple techniques such as ‘bending the fibre’ to interrupt all network traffic, resulting in the loss of availability of information.
Control 7.12 addresses how organisations can maintain the security of information assets transmitted via cables by implementing appropriate measures.
Control 7.12 enables organisations to achieve two distinct purposes:
Control 7.12 is preventive in nature as it requires organisations to apply precautionary measures against the risks to the availability and confidentiality of the information and other critical assets carried through cables.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Availability | #Protect | #Physical Security | #Protection |
Compliance with Control 7.12 requires creating an inventory of all cables, identifying appropriate security measures, carrying out a risk assessment and maintaining the security of cables.
While the facilities management team’s role and efforts are critical, the information security manager should bear the responsibility for compliance with Control 7.12.
Control 7.12 recommends organisations take into account the following four criteria for compliance:
Furthermore, organisations are also advised to seek expert advice on how to manage risks that may arise from cable malfunctioning.
Last but not the least, organisations should consider the risks related to the use of communications and power cables by more than one organisation when they are on shared premises.
27002:2022/7.12 replaces 27002:2013/(11.2.3)
While the Control 7.12 is similar to its 2013 counterpart to great extent, the Control 7.12 introduces the following requirement in the general guidance:
ISMS.Online is a complete solution for ISO 27002 implementation.
It is a web-based system that allows you to show that your information security management system (ISMS) is compliant with the approved standards using well thought out processes and procedures and checklists.
Get in touch today to book a demo.
It helps drive our behaviour in a positive way that works for us
& our culture.
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
