ASD ISM 0547Secure Protocols for Video and IP Telephony
Official control statement
Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Video and IP calls must use secure protocols to keep communications private and safe.
What this means in practice
This control is about making sure that the video and voice calls your organisation makes online are secure. If the protocols used aren't secure, sensitive information could be stolen or conversations could be intercepted by unauthorised people.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2021
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Topic
Protecting video conferencing and Internet Protocol telephony traffic
Why it matters
Unsecure video and IP calls risk data breaches through eavesdropping, leading to potential loss of sensitive information or reputational damage.
Operational notes
Audit video/IP telephony to enforce SRTP/DTLS-SRTP, disable insecure RTP, and verify encryption settings remain current after updates or changes.
Implementation tips
- Organisation managers should prioritise the use of secure communication software. Ensure the software for video calls or IP telephony is configured to employ secure protocols like Secure Real-time Transport Protocol (SRTP) and these settings are checked regularly.
- IT teams should update and patch video conferencing and telephony applications regularly. Plan for updates by scheduling checks weekly and consult vendor update notices to keep security features current.
- HR should train staff on the importance of secure communications. Conduct workshops to explain why using secure protocols is necessary and how to ensure their systems are set up correctly before starting a call.
- System administrators should regularly review system logs for any unusual activities in communication applications. Set a routine to analyse logs weekly for failed access attempts or unauthorised usage, indicating potential security breaches.
Audit / evidence tips
- AskNetwork configuration documents: Request documentation showing the communication applications' network setupLook atWhether secure protocols like SRTP are enabledGoodDocument will clearly indicate active secure protocols
- AskTo review the software update logsLook atEvidence that updates are applied regularlyGoodLog will show consistent updates, especially of security patches, occurring within a reasonable timeframe following release
- AskVendor certifications or agreements: These should outline the security guarantees of the communication softwareLook atAny documented support for secure protocol implementationGoodWill include a certificate or vendor statement confirming compliance
- AskTo see staff training records: Review records for training sessions about secure communication usageGoodIncludes recent attendance records, showing most of the relevant staff attended training within the past year
- AskLogs of communication sessions: Review how logs are monitored for securityGoodLog shows no unusual activities or flags any suspicious patterns that were followed up on appropriately
Cross-framework mappings
How ISM-0547 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.24 | ISM-0547 requires video conferencing and IP telephony calls to use a secure real-time transport protocol, which applies encryption and in... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications systems
See all Guidelines for communications systems controls, or browse the full ASD ISM library.