ASD ISM 0232 Encrypt external traffic for sensitive calls
What it says
Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSensitive phone calls should be encrypted to prevent eavesdropping when using outside systems.
This control is about making sure that any phone conversations involving sensitive information, like confidential business discussions or private client details, are protected from eavesdropping. This is important because if someone manages to listen in, they could misuse the information for financial gain or cause damage by leaking private details.
Free. Save your status, tasks and notes.
Why it matters
Without encrypting external calls, sensitive conversations can be intercepted, risking exposure of confidential data and potential business losses.
How to implement
Managers should ensure that all external phone calls involving sensitive information are made using systems that encrypt the call data.
This can be done by choosing a phone service provider that offers encryption for voice calls.
The IT team should configure the phone systems so that encryption is automatically applied to all outgoing calls.
This could involve setting up the system to use specific protocols or software that supports encrypted calls.
Procurement should prioritise vendors for phone systems that guarantee end-to-end encryption for calls and ensure that the vendors comply with Australian data protection laws.
Office managers should conduct regular training sessions for staff to highlight the importance of using secure, encrypted communication methods for sensitive calls.
Use examples of potential breaches to make the impact clear.
System owners should periodically review the encryption policies and practices of service providers to ensure they are up-to-date.
This can involve consulting with the provider's service agreement or security documentation to confirm compliance.
Keep it running
Regularly verify external call encryption (e.g., SIP over TLS and SRTP) on trunks and gateways, and confirm no fallback to unencrypted signalling or media.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of systems used for voice communications: Ensure the systems mentioned have encryption capabilities.
Look at
Documentation that specifically states encryption as a feature.
Good evidence
Includes confirmation that all systems used for sensitive calls support encryption.
- Check 2 of 5What an auditor asks for
Ask for
Them to describe how encryption is implemented and checked.
Look at
Clear descriptions of protocols or technologies used.
Good evidence
Involves specific mention of tools or protocols, such as Secure/Multipurpose Internet Mail Extensions (S/MIME) or Transport Layer Security (TLS).
- Check 3 of 5What an auditor asks for
Look at
Visual cues or messages in the system interface.
Good evidence
Is a visible confirmation of encryption during the call.
- Check 4 of 5What an auditor asks for
Ask for
To see the materials used to educate staff about secure communications and look for attendance logs.
Good evidence
Shows regular training sessions outreach to all users handling sensitive information.
- Check 5 of 5What an auditor asks for
Look at
Clauses that detail encryption standards and compliance with Australian laws.
Good evidence
Includes a signed contract detailing such terms.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0232 requires telephone systems used for sensitive or classified conversations to encrypt all traffic when it traverses external systems to prevent interception. ISO/IEC 27001:2022 Annex A 8.24 requires organisations to define and implement rules for the effective use of cryptography and cryptographic key management, which would include specifying encryption for communications such as voice/telephony over external networks. ISM-0232 is a specific use case (encrypted external telephony traffic), while Annex A 8.24 is broader and covers cryptography governance, selection and key management across many information flows.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.