ASD ISM 0233 Use encrypted cordless systems for sensitive conversations
What it says
Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not use cordless phones for sensitive talks unless they use ASD-approved encryption.
Cordless phones can be tricky for confidential conversations because anyone nearby with the right equipment could listen in. If you have to use them, make sure they're set up to encrypt calls so others can't eavesdrop on sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without encryption, unauthorised individuals could intercept your conversations, leading to data breaches or loss of confidentiality.
How to implement
IT team should review current cordless phone systems to check if they use encryption.
Check the manual or contact the manufacturer to verify what kind of security features are included.
The procurement manager should only purchase cordless phone systems with ASD-approved encryption.
Refer to the list of approved systems from the Australian Signals Directorate (ASD) for guidance.
Office managers should train staff on using encrypted phone systems to handle sensitive calls.
Arrange a short informational session demonstrating how to use these features.
System administrators should regularly update the firmware of cordless phone systems.
Check for updates on the manufacturer's website or contact their support to ensure encryption modules are up-to-date.
Legal advisors should work with the IT team to develop a policy regarding the use of encrypted cordless phones.
Draft a clear policy document that defines when encryption is necessary for phone calls.
Keep it running
Regularly check for and apply firmware updates to ensure your cordless phone systems maintain the necessary encryption standards.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the list of cordless phone systems in use: Request a record showing the types and models of phones currently used within the organisation.
Look at
details on encryption capabilities.
Good evidence
would show only ASD-approved systems being used for sensitive conversations.
- Check 2 of 5What an auditor asks for
Ask for
attendance records or training materials that cover the use of encrypted phone systems.
Look at
dates and employee signatures who attended.
Good evidence
provides thorough coverage of proper use.
- Check 3 of 5What an auditor asks for
Ask for
to see the procurement records for phone systems: Request purchase orders or invoices specifying the models of cordless systems bought. Examine these for any ASD-approved encryption verification.
Good evidence
confirms all new systems meet this control's encryption standard.
- Check 4 of 5What an auditor asks for
Ask for
the company's telecommunications policy.
Look at
sections that address the use of cordless phones and encryption.
Good evidence
policy explicitly mentions when and how encrypted systems must be used.
- Check 5 of 5What an auditor asks for
Ask for
records that detail when phone systems were last updated. Check that updates occurred in a timely manner and specifically whether they included any security patches related to encryption.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0233 requires that cordless telephone handsets and headsets are not used for sensitive or classified conversations unless the communications are encrypted. Annex A 8.24 requires an organisation to define and implement rules for the effective use of cryptography, which includes selecting approved encryption methods and managing keys for encrypted voice solutions to meet ISM-0233. Annex A 8.24 is cryptography-governance focused, while ISM-0233 is a specific confidentiality-in-transit rule.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.