Skip to content
Communications systems
ASD ISMISM-0547

ASD ISM 0547 Secure protocols for video and IP telephony

What it says

Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Video and IP calls must use secure protocols to keep communications private and safe.

This control is about making sure that the video and voice calls your organisation makes online are secure. If the protocols used aren't secure, sensitive information could be stolen or conversations could be intercepted by unauthorised people.

Why it matters

Unsecure video and IP calls risk data breaches through eavesdropping, leading to potential loss of sensitive information or reputational damage.

How to implement

  1. Organisation managers should prioritise the use of secure communication software.

    Ensure the software for video calls or IP telephony is configured to employ secure protocols like Secure Real-time Transport Protocol (SRTP) and these settings are checked regularly.

  2. IT teams should update and patch video conferencing and telephony applications regularly.

    Plan for updates by scheduling checks weekly and consult vendor update notices to keep security features current.

  3. HR should train staff on the importance of secure communications.

    Conduct workshops to explain why using secure protocols is necessary and how to ensure their systems are set up correctly before starting a call.

  4. System administrators should regularly review system logs for any unusual activities in communication applications.

    Set a routine to analyse logs weekly for failed access attempts or unauthorised usage, indicating potential security breaches.

Keep it running

Audit video/IP telephony to enforce SRTP/DTLS-SRTP, disable insecure RTP, and verify encryption settings remain current after updates or changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Network configuration documents: Request documentation showing the communication applications' network setup.

    Look at

    Whether secure protocols like SRTP are enabled.

    Good evidence

    Document will clearly indicate active secure protocols.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To review the software update logs.

    Look at

    Evidence that updates are applied regularly.

    Good evidence

    Log will show consistent updates, especially of security patches, occurring within a reasonable timeframe following release.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Vendor certifications or agreements: These should outline the security guarantees of the communication software.

    Look at

    Any documented support for secure protocol implementation.

    Good evidence

    Will include a certificate or vendor statement confirming compliance.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see staff training records: Review records for training sessions about secure communication usage.

    Good evidence

    Includes recent attendance records, showing most of the relevant staff attended training within the past year.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Logs of communication sessions: Review how logs are monitored for security.

    Good evidence

    Log shows no unusual activities or flags any suspicious patterns that were followed up on appropriately.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.