ASD ISM 0548Ensure Secure Protocols for Video and IP Calls
Official control statement
Video conferencing and IP telephony calls are established using a secure session initiation protocol.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Video and IP calls must use secure protocols to protect communication.
What this means in practice
This control ensures that video calls and voice calls over the internet use secure technologies to protect the conversations. It's crucial because if someone can tap into these calls, they might steal sensitive information or eavesdrop on confidential discussions, which could lead to privacy breaches or business losses.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2021
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Topic
Protecting video conferencing and Internet Protocol telephony traffic
Why it matters
If video/IP calls do not use secure SIP (e.g., SIP over TLS with SRTP), attackers can intercept or alter call audio/video and signalling.
Operational notes
Require SIP over TLS and SRTP for all video/IP call services; regularly verify client/device configs and disable insecure SIP transports.
Implementation tips
- The IT team should review current video conferencing and internet calling tools to make sure they use secure protocols. This involves checking the settings of each tool and any documentation provided by the service providers to ensure they support secure methods like encrypted connections.
- Managers and team leaders should conduct training sessions to make sure users understand how to start a secure video conference or call. They should give clear steps and demonstrations on picking the right settings in everyday tools like Zoom or Skype.
- The procurement team must include security requirements when purchasing new video conferencing or IP telephony solutions. They should require vendors to confirm that their products use secure protocols and provide evidence or certification.
- Operations personnel should regularly update the software used for video and IP calls to the latest version. Regular checks and updates can be done by setting reminders and keeping a log of software versions and update dates.
- The security team should run periodic checks to ensure all video and IP telephony systems are correctly configured for security. They can do this by simulating calls and verifying if the security settings are enforced, which involves checking the connection type and encryption status.
Audit / evidence tips
- AskSystem configuration records: Request to see documentation or screenshots showing current settings for video and IP call systemsLook atThe configured protocols to check they specify secure options like encryptionGoodDetailed settings that clearly indicate secure protocols are enabled
- AskTraining materials: Request to see resources or records used in user training sessions about secure callsLook atClear instructions on how to initiate secure callsGoodComprehensive guides with step-by-step instructions and tips for secure usage
- AskVendor security assurances: Request evidence of security protocols as part of purchase requirementsLook atVendor confirmations or certificates that guarantee the use of secure protocols. Good is a document or email from the vendor confirming secure technologies in place
- AskSoftware update logs: Request logs of updates for the systems in useLook atUpdate dates and version numbers to ensure timely updatesGoodA log with recent dates showing that software is kept current against security threats
- AskTest results or reports from security checks: Request reports from security checks or simulationsLook atAnalyses of connection types and encryption effectivenessGoodA report confirming that security settings are correctly applied
Cross-framework mappings
How ISM-0548 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| Annex A 8.20 | ISM-0548 requires video conferencing and IP telephony calls to be established using a secure session initiation protocol to protect call ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications systems
See all Guidelines for communications systems controls, or browse the full ASD ISM library.