ASD ISM 0245 Prevent MFD connections to digital phone systems
What it says
MFDs are not connected to digital telephone systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not connect multifunction devices (MFDs) to digital telephone systems.
This control means that multifunction devices, like printers and scanners, shouldn't be connected directly to digital telephone systems. It's important because if these devices are connected, they could be used by cybercriminals to access sensitive information or disrupt communications, which can lead to loss of privacy and financial harm.
Free. Save your status, tasks and notes.
Why it matters
If an MFD is connected to a digital phone system, call/fax features may be abused to intercept documents, exfiltrate data, or disrupt telephony services.
How to implement
IT team should ensure MFDs are configured to not connect to any telephone systems.
They can do this by checking device settings and disabling any telephone connectivity options.
System owners should conduct regular checks to confirm that MFDs are not used in ways that could involve digital telephone systems.
They can do this by reviewing device use logs and configurations periodically.
Procurement managers should ensure new MFDs do not have digital telephone capabilities or these features can be disabled before purchase.
They should request this information from vendors during the acquisition process.
Office managers should train staff on the importance of keeping MFDs separate from telephone systems.
This training should include a simple explanation of the risks and a quick demo of what not to connect.
IT administrators should set up network monitoring to spot any unauthorised connections involving MFDs.
They can use existing network management tools to alert if such connections are attempted.
Keep it running
Verify MFDs have no PBX/digital phone line connections (fax/modem cards, RJ11/RJ45 ports); audit cabling and disable phone interfaces where possible.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The device configurations document: Request documentation showing the settings of MFDs, specifically looking for entries about telephone connections.
Look at
Clear configurations indicating no telephone connectivity.
Good evidence
Is complete documentation showing these settings are in place.
- Check 2 of 3What an auditor asks for
Ask for
Them how they ensure MFDs aren't connected to telephone systems.
Good evidence
Will clearly describe steps taken to disable such connections and regular checks.
- Check 3 of 3What an auditor asks for
Ask for
Procurement records: Check documents for recent MFD purchases to verify they did not include telephone connectivity or that such features were disabled. Good records will show these details in the purchase agreements.
Good evidence
Result is logs showing no attempts at such connections or alerts when they were blocked.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-0245 requires that multifunction devices (MFDs) are not connected to digital telephone systems to remove an insecure or unnecessary communications pathway. Annex A 8.20 requires networks and network devices to be secured and controlled, which includes designing and enforcing permitted/blocked network interconnections. ISM-0245 is a specific network-segmentation/connection-prohibition implementation, while Annex A 8.20 is broader and covers overall network security management beyond telephony connections.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.