Skip to content
Communications systems
ASD ISMISM-0236

ASD ISM 0236 Implement off-hook audio protection on telephones

What it says

Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use features to prevent phone conversations being heard in sensitive areas.

This control is about making sure that phone conversations in areas with sensitive or classified information can't be accidentally overheard when a phone is left off the hook. If this isn't managed, confidential discussions could be listened to by unauthorised people, risking privacy breaches and potential leaks of sensitive data.

Why it matters

Without off-hook audio protection, sensitive nearby conversations may be picked up by off-hook handsets and disclosed beyond the phone system's authorised classification.

How to implement

  1. IT team should install off-hook audio protection features: This involves configuring the phone systems to automatically mute the microphone when the handset is off the hook but not in active use.

    Use the phone system's settings to activate this feature or consult the manual for guidance.

  2. Procurement should ensure new phone systems include audio protection features: When buying new phones, specify models that include off-hook audio protection capabilities.

    Check product specifications or ask vendors about these features before purchase.

  3. Office managers should provide training sessions: Arrange short training sessions for staff on the importance of off-hook audio protection and how to use it.

    Demonstrate how to check if off-hook protection is enabled on the phone and what actions to take if they suspect it's not.

  4. System administrator should regularly test the feature: Conduct periodic checks on randomly selected phones to ensure the off-hook protection is active and functioning properly.

    Document the test process and any issues found for follow-up.

  5. Information security team should review policies: Review and update organisational policies to include requirements for off-hook audio protection in sensitive areas, ensuring staff understand their roles and responsibilities in maintaining phone security.

Keep it running

Regularly test off-hook audio protection on handsets/speakerphones in high-risk areas and document results, fixing or disabling devices that can capture room conversations.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    A list of phone models in use: Check that the phones listed are equipped with off-hook audio protection features.

    Good evidence

    Will mention specific models and their protection capabilities.

  2. Check 2 of 4What an auditor asks for

    Look at

    Documents showing regular testing of the off-hook features.

    Good evidence

    Will be logs demonstrating both scheduled tests and any corrective actions taken.

  3. Check 3 of 4What an auditor asks for

    Ask for

    Them to describe how they check and use off-hook protection on their phones.

    Good evidence

    Is staff confidently detailing the process and showing awareness of its importance.

  4. Check 4 of 4What an auditor asks for

    Good evidence

    Shows clear mention of this requirement and responsibilities.

Mappings

Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.