Skip to content
Communications systems
ASD ISMISM-0235

ASD ISM 0235 Use of speakerphones in TOP SECRET areas

What it says

Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Speakerphones can only be used in secure rooms when discussing TOP SECRET matters.

This rule is about using speakerphones for discussions involving TOP SECRET information. You can only use speakerphones in specially secured rooms, where conversations can't be overheard by unauthorised people. If this isn't followed, sensitive information could be accidentally shared, leading to serious security breaches.

Why it matters

Using speakerphones in TOP SECRET areas outside an audio secure room can allow conversations to be overheard, causing compromise.

How to implement

  1. The office manager should ensure that all areas where TOP SECRET discussions happen are assessed for audio security.

    This means getting a professional to check that sound can't leave the room and eavesdropping devices can't capture conversations.

  2. IT staff should set up telephones with speakerphone capabilities only in rooms verified as audio secure.

    They should use headsets or secure communication devices in other areas to prevent accidental leakage of sensitive information.

  3. Managers need to brief their teams about which rooms are secure for using speakerphones.

    They should create a simple list of approved rooms and post it where employees can see it daily, like next to the phones or on the company intranet.

  4. Security officers should establish a procedure for verifying who is present during TOP SECRET calls.

    Before the conversation starts, someone should check and log all individuals in the room to ensure everyone there is authorised to hear the information.

  5. Policy writers should update the organisation's communication guidelines to include specific sections on the use of speakerphones in TOP SECRET discussions.

    Clearly outline what constitutes an audio-secure room and the steps to follow for any exceptions.

Keep it running

Allow speakerphone use only in an audio secure room, verify audio security before calls, and ensure only call participants are present.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of audio-secure rooms: Request the document or log detailing all rooms checked and deemed secure for speakerphone use.

    Look at

    Whether each room has been evaluated and approved by a security expert.

    Good evidence

    Shows detailed room checks and approval dates.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Scenario is seeing soundproofing techniques in place and the use of monitoring equipment to detect audio leaks.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Them to describe the process they follow.

    Good evidence

    Includes mentioning name checks and an attendance log or system.

  4. Check 4 of 5What an auditor asks for

    Look at

    Evidence that employees are informed about speakerphone use policies.

    Good evidence

    Document indicates recent training dates and outlines procedures clearly.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Policy is explicit, recently dated, and widely accessible to all staff.

Mappings

Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.7.6Security measures for working in secure areasPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.