ASD ISM 0230 Advising on risks of non-secure telephone systems
What it says
Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff are informed about security dangers of using unsecured phones for sensitive talks.
This control is about making sure your team knows the potential risks of discussing sensitive information over non-secure phone lines. It's like knowing not to yell out private information in a crowded room. If you don't, someone could overhear these conversations and misuse the information, leading to data breaches or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Using non-secure phones for sensitive or classified calls can enable eavesdropping, leading to unauthorised disclosure of protected information.
How to implement
Manager should develop a communication policy: Clearly outline situations where secure communications are needed and specify when not to use standard phone lines.
Share this policy with all staff during training sessions.
HR should provide employee training: Conduct regular sessions to educate staff on the risks of using unsecured phones for sensitive talks.
Use real-world examples to show how leaks can occur.
IT team should evaluate phone systems: Identify if the existing telephone system can be configured for better security or if secure lines need to be established.
Look into options like encrypted phone lines or secure VoIP services.
Office manager should establish secure areas: Designate specific rooms or areas where sensitive calls can be taken using secure lines.
Ensure these areas are marked clearly and access is controlled.
Compliance officer should perform regular checks: Keep track of how often secure communication procedures are followed and remind staff of the importance of these practices in periodic updates.
Keep it running
Regularly remind staff not to discuss sensitive or classified topics on non-secure phone lines; use approved secure telephony where available.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The communication policy document: Request the organisation's policy outlining when to use secure lines for sensitive calls.
Look at
The clarity of guidelines and distribution method.
Good evidence
Policy is well-documented, easy to understand, and readily accessible to staff.
- Check 2 of 5What an auditor asks for
Ask for
A sample of employees about the training they've received regarding secure phone use.
Look at
Consistent understanding of when and how to use secure lines.
Good evidence
Is that staff are aware and can recall key points from training.
- Check 3 of 5What an auditor asks for
Good evidence
List matches what you see on a walk-through.
- Check 4 of 5What an auditor asks for
Look at
Evidence of encryption or access restrictions.
Good evidence
Configuration includes encryption settings actively in use.
- Check 5 of 5What an auditor asks for
Look at
Regular updates and issues addressed.
Good evidence
Log shows consistent monitoring and corrective actions.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-0230 requires personnel to be advised of the security risks of using non-secure telephone systems in areas where sensitive or classified conversations can occur. Annex A 6.3 requires an organisation-wide information security awareness, education and training program, which would typically include guidance on secure communications channels (including telephony) where relevant to roles. ISM-0230 is a topic-specific awareness requirement, while Annex A 6.3 is broader and covers awareness across many security topics and audiences.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.