ASD ISM 0236 Implement off-hook audio protection on telephones
What it says
Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse features to prevent phone conversations being heard in sensitive areas.
This control is about making sure that phone conversations in areas with sensitive or classified information can't be accidentally overheard when a phone is left off the hook. If this isn't managed, confidential discussions could be listened to by unauthorised people, risking privacy breaches and potential leaks of sensitive data.
Free. Save your status, tasks and notes.
Why it matters
Without off-hook audio protection, sensitive nearby conversations may be picked up by off-hook handsets and disclosed beyond the phone system's authorised classification.
How to implement
IT team should install off-hook audio protection features: This involves configuring the phone systems to automatically mute the microphone when the handset is off the hook but not in active use.
Use the phone system's settings to activate this feature or consult the manual for guidance.
Procurement should ensure new phone systems include audio protection features: When buying new phones, specify models that include off-hook audio protection capabilities.
Check product specifications or ask vendors about these features before purchase.
Office managers should provide training sessions: Arrange short training sessions for staff on the importance of off-hook audio protection and how to use it.
Demonstrate how to check if off-hook protection is enabled on the phone and what actions to take if they suspect it's not.
System administrator should regularly test the feature: Conduct periodic checks on randomly selected phones to ensure the off-hook protection is active and functioning properly.
Document the test process and any issues found for follow-up.
Information security team should review policies: Review and update organisational policies to include requirements for off-hook audio protection in sensitive areas, ensuring staff understand their roles and responsibilities in maintaining phone security.
Keep it running
Regularly test off-hook audio protection on handsets/speakerphones in high-risk areas and document results, fixing or disabling devices that can capture room conversations.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
A list of phone models in use: Check that the phones listed are equipped with off-hook audio protection features.
Good evidence
Will mention specific models and their protection capabilities.
- Check 2 of 4What an auditor asks for
Look at
Documents showing regular testing of the off-hook features.
Good evidence
Will be logs demonstrating both scheduled tests and any corrective actions taken.
- Check 3 of 4What an auditor asks for
Ask for
Them to describe how they check and use off-hook protection on their phones.
Good evidence
Is staff confidently detailing the process and showing awareness of its importance.
- Check 4 of 4What an auditor asks for
Good evidence
Shows clear mention of this requirement and responsibilities.
Mappings
Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.6.
ISM-0236 requires organisations to implement off-hook audio protection on telephone systems in areas where background conversations may exceed the sensitivity/classification the phone system is authorised for. This relates to ISO/IEC 27001:2022 Annex A 7.6 because protecting work practices in secure areas includes preventing inadvertent disclosure through overheard conversations and acoustic leakage from communications devices. Annex A 7.6 is broader (covers general secure-area working measures), while ISM-0236 is a specific technical/operational measure for telephony in those areas.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.




