ASD ISM 0554Secure Two-Way Authentication for Video Calls
Official control statement
An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Video calls must use secure two-way authentication to ensure calls are encrypted and cannot be reused.
What this means in practice
This control is about making sure that your video calls are extra secure by using a method that checks both sides before letting the call begin, and it ensures that these calls can't be tampered with or listened to by anyone else. This is important because if you don't secure your video calls, sensitive information you share could be stolen or misused, putting your business or personal conversations at risk.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2018
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Topic
Video conferencing unit and Internet Protocol phone authentication
Why it matters
Without secure two-way authentication, attackers can spoof participants or replay call setup messages, exposing sensitive business or personal information during video calls.
Operational notes
Regularly test mutual authentication on video calls and validate anti-replay protections (nonces/timestamps) to ensure call setup messages cannot be reused or spoofed.
Implementation tips
- The IT team should set up secure video call software that supports two-way authentication. This means both callers must confirm their identity before the call starts. The IT team can implement this by choosing video conferencing tools with strong security features and configuring them to require user verification each time a call is initiated.
- System owners should work with the IT team to ensure call encryption is enabled. This involves checking the settings in your video call software to make sure encryption is turned on, which protects the content of your calls from being accessed by unauthorised parties.
- Managers need to communicate the importance of secure video calls to their team members. They can do this by organising brief training sessions that explain how and why to use two-way authentication and encryption for every business call.
- The HR department should incorporate secure communication practices into the employee handbook. This can include guidelines on using video conferencing safely, such as not sharing passwords and ensuring devices are protected with strong, unique passwords.
- Procurement should assess and select video conferencing services that comply with Australian security standards, such as those recommended by the Australian Cyber Security Centre (ACSC). They can do this by reviewing product specifications and opting for services with strong security credentials verified by reliable agencies.
Audit / evidence tips
- AskDocumentation of the video conferencing tools being used: Request a list of software tools approved for secure video calls within the organisationLook atWhether these tools offer two-way authentication featuresGoodList will only include software that supports secure authentication and encryption standards
- AskTo see the configuration settings of the video call software: Request access to the configuration or security settings of the video conferencing toolLook atSettings where two-way authentication and encryption are enabledGoodResult is settings that confirm these security measures are in place for every call
- AskRecords of employee training on secure communication: Request documents or logs showing when employees were last trained on using secure video calling practicesLook atRecent training sessions that cover secure communication and how to authenticate callsGoodWould be records of regular training sessions and updates
- AskA policy document on video call security: Request the organisation's policy that outlines requirements for secure video callsLook atHow the document describes the need for two-way authentication and encryption. A well-written policy will clearly outline procedures and responsibilities related to secure video calls
- AskLogs of video call usages: Request logs that might record when and how video calls are conducted using authenticated and encrypted methods as part of regular checksLook atEntries that show compliance with security protocols for each callGoodLog will show consistent adherence to two-way authentication and encryption usage
Cross-framework mappings
How ISM-0554 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.5 | ISM-0554 requires an encrypted and non-replayable two-way authentication scheme specifically for video call authentication and authorisation | |
extensionDepends on(1)expand_less | ||
| Annex A 8.24 | ISM-0554 requires video call authentication to use encrypted, non-replayable two-way authentication, which relies on strong cryptographic... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications systems
See all Guidelines for communications systems controls, or browse the full ASD ISM library.