ASD ISM 0231 Visual indication for secure telephone connections
What it says
When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTelephone systems must show a visual cue for the security level of a call when using encryption.
Imagine you're on a phone call discussing sensitive information. You want to know if the chat is secure. This control helps by making sure your phone shows a visual signal, like a green light or an icon, indicating the security level when calls are encrypted. This matters because without it, you risk discussing private data over insecure lines, potentially exposing your business to eavesdropping or data breaches.
Free. Save your status, tasks and notes.
Why it matters
Without a visual indication of secure vs non-secure calls, staff may discuss classified or sensitive information on an insecure link, causing disclosure.
How to implement
IT team should ensure that phone systems are equipped with the capability to display security indicators.
Research phone systems that have this feature and verify with suppliers before purchasing or upgrading systems.
System administrators need to configure the phone systems to show the right visual cues.
Follow the manufacturer's instructions to set up the display that indicates when a secure or unsecure connection is being used.
Office managers or the IT team should train staff on what the security indicators mean.
Organise a briefing session where employees can learn to recognise the visual cues and understand the implications of different security levels.
Procurement should include criteria for encrypted communication and visual indicators in vendor contracts.
When contracting new phone services, specify the need for visual security indicators as a must-have feature.
Managers should conduct regular checks to ensure the visual indicators are functioning correctly.
Schedule monthly tests where selected employees make a secure connection and confirm the visual cue is shown.
Keep it running
Confirm telephones clearly display the secure/non-secure connection state when crypto is used; train users to verify it before speaking and to report indicator faults.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The phone system vendor documentation: Request the documentation that describes how the visual indicators work.
Look at
Sections specifying the capability to show secure or unsecure connections.
Good evidence
Includes a detailed explanation of these functions in the documentation.
- Check 2 of 5What an auditor asks for
Look at
The phone system configuration settings: Request access to the system settings or a printout that shows these visual indicators are enabled. Check for options that activate or deactivate security cues.
Good evidence
Has the settings clearly showing these features are active.
- Check 3 of 5What an auditor asks for
Ask for
Employees if they can recognise the visual indicators and understand their meanings.
Good evidence
Is staff members who can accurately describe what the indicators signify and when they're used.
- Check 4 of 5What an auditor asks for
Good evidence
Is a clear visual signal, like a light or icon, appearing on the phone display.
- Check 5 of 5What an auditor asks for
Ask for
Logs showing regular checks have been performed on the system.
Look at
Whether any issues with visual indicators were identified and addressed.
Good evidence
Includes dated records with actions taken to fix any indicator problems.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.14.
ISM-0231 requires telephone systems that use cryptographic equipment to support different levels of conversation to visually indicate which kind of connection has been made. This gives users the cue they need to follow information transfer rules for voice communications, such as not discussing sensitive information over an unsecured connection, which Annex A 5.14 requires for all transfer facilities. Annex A 5.14 covers rules, procedures and agreements for every type of transfer, while ISM-0231 is a narrow technical measure for secure telephony.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.