ASD ISM 0229 Guidelines for discussing sensitive information over phones
What it says
Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff are informed about what sensitive information can be talked about on phone calls.
When you're chatting on the phone, it's important to know what sensitive information can be shared. This matters because saying the wrong thing could let the wrong people overhear confidential details, leading to security breaches or data loss.
Free. Save your status, tasks and notes.
Why it matters
Discussing sensitive or classified information over internal or external phones may lead to unauthorised disclosure and compromise of protective security requirements.
How to implement
Managers should clearly mark which pieces of information are considered sensitive in their workplace.
They can do this by creating a simple guideline document or holding a staff meeting to explain what's okay to discuss over the phone and what's not.
Supervisors should train employees on how to handle phone calls involving sensitive information.
They can set up role-playing sessions to practice these calls, ensuring everyone knows how to manage them effectively and securely.
IT departments should evaluate the safety measures of internal and external phone systems.
This involves checking if existing systems offer encryption or other security features to help keep phone conversations private.
Human Resources should include phone communication guidelines as part of the onboarding process.
New employees should receive a clear list of dos and don'ts regarding what they can discuss on the phone.
Business owners should conduct regular audits to ensure staff compliance with these guidelines.
This can be done by reviewing call procedures and having refreshers or updates when necessary.
Keep it running
Provide staff briefings and quick-reference guidance on what classifications can be discussed over internal vs external phones, with periodic refreshers.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The phone communication guidelines: Request the document or email that sets out what is considered sensitive information.
Look at
The clarity and detail of what is classified as sensitive.
Good evidence
Will include specifics about which topics require caution over phone discussions.
- Check 2 of 5What an auditor asks for
Ask for
A few employees how they handle sensitive information on phone calls and if they received training.
Look at
Consistency in their answers relating to what information can be shared verbally.
Good evidence
Is if they correctly identify sensitive information and refer to the guidelines.
- Check 3 of 5What an auditor asks for
Look at
The session content and engagement levels.
Good evidence
Shows that staff understand and can apply the guidelines practically.
- Check 4 of 5What an auditor asks for
Look at
Assessments that detail encryption or privacy features.
Good evidence
Features a recent assessment with noted actions to improve security.
- Check 5 of 5What an auditor asks for
Good evidence
Includes documented follow-up actions and improved processes.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-0229 requires personnel to be advised what sensitivity or classification of information is permitted to be discussed over internal and external telephone systems. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide information security awareness, education and training program covering policies and procedures relevant to job functions, which is the natural vehicle for communicating phone discussion rules. ISM-0229 is a specific, topic-level awareness requirement focused on telephony, while Annex A 6.3 is broader and covers awareness across many topics beyond phone communications.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.