ASD ISM 0551 Ensure secure IP telephony device authentication
What it says
IP telephony is configured such that: - IP phones authenticate themselves to the call controller upon registration - auto-registration is disabled and only authorised devices are allowed to access the network - unauthorised devices are blocked by default - all unused and prohibited functionality is disabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only authorised IP phones can register and use the network, blocking unauthorised and unused functionalities.
This control ensures that only the phones you have approved can connect to your office phone network. This is important because if unauthorised devices join the network, they could listen in on private conversations or cause disruptions, much like leaving the door open to anyone who wants to walk in uninvited.
Free. Save your status, tasks and notes.
Why it matters
Without IP phone authentication and auto-registration disabled, rogue handsets can register to the call controller, enabling call eavesdropping and network disruption.
How to implement
The IT team should create a list of approved IP phones: Gather the serial numbers of all authorised phones and record them in a secure document.
Use this list to ensure only these devices can register on the network.
The IT manager should disable auto-registration on the call controller: Access the settings of the call management system and turn off the feature that automatically allows new devices to connect.
This ensures only listed and approved devices can get onto the system.
Network administrators should configure the system to block unauthorised devices: Set the firewall or the call controller's security settings to reject unknown device attempts to connect.
This proactive step ensures unauthorised phones can't access the network.
The security officer should audit network access logs regularly: Review the logs weekly to check for any attempts by unauthorised devices to connect.
Investigate any unusual activity and make sure it aligns with employees' use.
The IT team should disable unused functions: Go through the phone system settings and turn off features that are not in use, like conference calling if it's unnecessary.
This reduces risk by limiting ways the system can be misused.
Keep it running
Ensure auto-registration is disabled, only authorised phones can register to the call controller, and unknown devices are blocked by default; disable unused/prohibited IP phone functionality.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The list of authorised IP phones: Request a document or electronic list that contains all approved devices allowed on the network.
Look at
Unique identifiers, such as serial numbers, next to each device. Good evidence shows recent updates with a date and any new devices added after approval.
- Check 2 of 4What an auditor asks for
Look at
Entries showing connections only from authorised phone serial numbers.
Good evidence
Log shows attempts from unknown devices being blocked.
- Check 3 of 4What an auditor asks for
Ask for
Network security policy documents: Confirm there's a policy detailing how devices are authenticated before joining the network.
Look at
Explanations about how the system differentiates between authorised and unauthorised devices. A well-detailed document spells out processes for reviews and updates.
Good evidence
Setup will include automatic defences that function without needing manual intervention.
- Check 4 of 4What an auditor asks for
Ask for
Training records or minutes from security meetings: Review evidence showing staff were briefed on these practices.
Look at
Meeting summaries discussing policy or training sessions. Quality evidence includes the dates of these activities and topics discussed.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.15.
ISM-0551 mandates specific access control configuration for IP telephony, including authenticated registration, disabling auto-registration, and default-deny for unauthorised devices and functions. Annex A 5.15 requires the organisation to establish and implement access control policies and procedures based on business and security requirements. ISM-0551 is a specific technical control that would typically be required by, and sit underneath, the broader policy/procedure expectations of Annex A 5.15.
This control partially meets A.8.3.
ISM-0551 requires only authorised IP phones to be permitted to register and access the telephony network, with unauthorised devices blocked by default and unnecessary functions disabled. This maps to Annex A 8.3 because it is a concrete access restriction applied to a specific class of assets (IP telephony endpoints and call control infrastructure). Annex A 8.3 is broader, covering restriction of access to all information and associated assets, not just IP telephony device admission and feature hardening.
This control partially meets A.8.5.
ISM-0551 requires IP telephony to enforce secure device registration by having IP phones authenticate to the call controller, disabling auto-registration, blocking unauthorised devices by default, and disabling unused/prohibited functions. This aligns with Annex A 8.5 which requires implementing secure authentication technologies and procedures appropriate to access restrictions. ISM-0551 is a technology-specific instantiation (IP phone-to-call-controller authentication and admission control) of the broader authentication requirement in Annex A 8.5.
This control partially meets A.8.20.
ISM-0551 focuses on securing IP telephony network access by authenticating endpoints to the call controller, preventing auto-registration, and disabling unused/prohibited functionality. This relates to Annex A 8.20 because call controllers, voice VLANs, and IP phones are network devices/services that need to be managed and controlled to protect information and services. Annex A 8.20 is broader and covers overall network and network device security beyond telephony registration controls and feature lockdown.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.