ASD ISM 0554 Secure two-way authentication for video calls
What it says
An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVideo calls must use secure two-way authentication to ensure calls are encrypted and cannot be reused.
This control is about making sure that your video calls are extra secure by using a method that checks both sides before letting the call begin, and it ensures that these calls can't be tampered with or listened to by anyone else. This is important because if you don't secure your video calls, sensitive information you share could be stolen or misused, putting your business or personal conversations at risk.
Free. Save your status, tasks and notes.
Why it matters
Without secure two-way authentication, attackers can spoof participants or replay call setup messages, exposing sensitive business or personal information during video calls.
How to implement
The IT team should set up secure video call software that supports two-way authentication.
This means both callers must confirm their identity before the call starts. The IT team can implement this by choosing video conferencing tools with strong security features and configuring them to require user verification each time a call is initiated.
System owners should work with the IT team to ensure call encryption is enabled.
This involves checking the settings in your video call software to make sure encryption is turned on, which protects the content of your calls from being accessed by unauthorised parties.
Managers need to communicate the importance of secure video calls to their team members.
They can do this by organising brief training sessions that explain how and why to use two-way authentication and encryption for every business call.
The HR department should incorporate secure communication practices into the employee handbook.
This can include guidelines on using video conferencing safely, such as not sharing passwords and ensuring devices are protected with strong, unique passwords.
Procurement should assess and select video conferencing services that comply with Australian security standards, such as those recommended by the Australian Cyber Security Centre (ACSC).
They can do this by reviewing product specifications and opting for services with strong security credentials verified by reliable agencies.
Keep it running
Regularly test mutual authentication on video calls and validate anti-replay protections (nonces/timestamps) to ensure call setup messages cannot be reused or spoofed.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documentation of the video conferencing tools being used: Request a list of software tools approved for secure video calls within the organisation.
Look at
Whether these tools offer two-way authentication features.
Good evidence
List will only include software that supports secure authentication and encryption standards.
- Check 2 of 5What an auditor asks for
Ask for
To see the configuration settings of the video call software: Request access to the configuration or security settings of the video conferencing tool.
Look at
Settings where two-way authentication and encryption are enabled.
Good evidence
Result is settings that confirm these security measures are in place for every call.
- Check 3 of 5What an auditor asks for
Ask for
Records of employee training on secure communication: Request documents or logs showing when employees were last trained on using secure video calling practices.
Look at
Recent training sessions that cover secure communication and how to authenticate calls.
Good evidence
Would be records of regular training sessions and updates.
- Check 4 of 5What an auditor asks for
Ask for
A policy document on video call security: Request the organisation's policy that outlines requirements for secure video calls.
Look at
How the document describes the need for two-way authentication and encryption. A well-written policy will clearly outline procedures and responsibilities related to secure video calls.
- Check 5 of 5What an auditor asks for
Ask for
Logs of video call usages: Request logs that might record when and how video calls are conducted using authenticated and encrypted methods as part of regular checks.
Look at
Entries that show compliance with security protocols for each call.
Good evidence
Log will show consistent adherence to two-way authentication and encryption usage.
Mappings
Closest match in ISO/IEC 27001: A.8.5, Secure authentication technologies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.5.
ISM-0554 requires an encrypted and non-replayable two-way authentication scheme specifically for video call authentication and authorisation. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented more generally, based on access restrictions and access control policy. ISM-0554 is a concrete, use-case-specific application of secure authentication, adding explicit anti-replay and call-session context that Annex A 8.5 does not spell out.
This control depends on A.8.24.
ISM-0554 requires video call authentication to use encrypted, non-replayable two-way authentication, which relies on strong cryptographic mechanisms to protect the handshake and prevent replay. ISO/IEC 27001:2022 Annex A 8.24 establishes rules for effective cryptography and cryptographic key management that underpin how such authentication encryption and integrity protections are implemented. Annex A 8.24 is about cryptographic governance and key handling, whereas ISM-0554 is about applying cryptography to a specific mutual authentication scenario for video calls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.