ASD ISM 0548 Ensure secure protocols for video and IP calls
What it says
Video conferencing and IP telephony calls are established using a secure session initiation protocol.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVideo and IP calls must use secure protocols to protect communication.
This control ensures that video calls and voice calls over the internet use secure technologies to protect the conversations. It's crucial because if someone can tap into these calls, they might steal sensitive information or eavesdrop on confidential discussions, which could lead to privacy breaches or business losses.
Free. Save your status, tasks and notes.
Why it matters
If video/IP calls do not use secure SIP (e.g., SIP over TLS with SRTP), attackers can intercept or alter call audio/video and signalling.
How to implement
The IT team should review current video conferencing and internet calling tools to make sure they use secure protocols.
This involves checking the settings of each tool and any documentation provided by the service providers to ensure they support secure methods like encrypted connections.
Managers and team leaders should conduct training sessions to make sure users understand how to start a secure video conference or call.
They should give clear steps and demonstrations on picking the right settings in everyday tools like Zoom or Skype.
The procurement team must include security requirements when purchasing new video conferencing or IP telephony solutions.
They should require vendors to confirm that their products use secure protocols and provide evidence or certification.
Operations personnel should regularly update the software used for video and IP calls to the latest version.
Regular checks and updates can be done by setting reminders and keeping a log of software versions and update dates.
The security team should run periodic checks to ensure all video and IP telephony systems are correctly configured for security.
They can do this by simulating calls and verifying if the security settings are enforced, which involves checking the connection type and encryption status.
Keep it running
Require SIP over TLS and SRTP for all video/IP call services; regularly verify client/device configs and disable insecure SIP transports.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
System configuration records: Request to see documentation or screenshots showing current settings for video and IP call systems.
Look at
The configured protocols to check they specify secure options like encryption.
Good evidence
Detailed settings that clearly indicate secure protocols are enabled.
- Check 2 of 5What an auditor asks for
Ask for
Training materials: Request to see resources or records used in user training sessions about secure calls.
Look at
Clear instructions on how to initiate secure calls.
Good evidence
Comprehensive guides with step-by-step instructions and tips for secure usage.
- Check 3 of 5What an auditor asks for
Ask for
Vendor security assurances: Request evidence of security protocols as part of purchase requirements.
Look at
Vendor confirmations or certificates that guarantee the use of secure protocols. Good is a document or email from the vendor confirming secure technologies in place.
- Check 4 of 5What an auditor asks for
Ask for
Software update logs: Request logs of updates for the systems in use.
Look at
Update dates and version numbers to ensure timely updates.
Good evidence
A log with recent dates showing that software is kept current against security threats.
- Check 5 of 5What an auditor asks for
Ask for
Test results or reports from security checks: Request reports from security checks or simulations.
Look at
Analyses of connection types and encryption effectiveness.
Good evidence
A report confirming that security settings are correctly applied.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.8.20.
ISM-0548 requires video conferencing and IP telephony calls to be established using a secure session initiation protocol to protect call signalling and session setup. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured and managed, which supports the ability to enforce and protect secure SIP configurations (e.g. allowing only secure signalling, restricting ports, and controlling gateway/proxy behaviour). Annex A 8.20 is broader network security governance, while ISM-0548 is a specific control focused on secure call/session initiation protocols.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.