ASD ISM 0555 Ensure authentication for IP telephony actions
What it says
Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUsers must be verified for all actions such as registering phones and accessing voicemail on IP telephony networks.
This control is about making sure that only authorised people can do things like register phones or listen to voicemails on your office internet phone system. Without this, someone could tamper with your phone settings or access private messages, putting your business communications at risk.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised IP telephony actions can enable call interception, voicemail compromise, fraud, and disruption of critical voice services.
How to implement
Business owners should ensure they have an authentication system for internet phones.
This means setting up a username and password or PIN that people must use to prove who they are before they can make changes or access voicemail.
IT teams should implement multi-factor authentication (MFA) across the IP telephony network.
This involves setting up a system where users need to provide two or more pieces of evidence to prove their identity, like a password and a code sent to their phone.
Managers should train staff on the importance of using unique and strong passwords for accessing IP phone systems.
Host a workshop to show employees how to create strong passwords and why reusing passwords is risky.
The security officer should regularly review and update access permissions for the entire IP telephony system.
Check every quarter to ensure that only current employees have access and that former staff are promptly removed from the system.
The IT team should routinely monitor the IP telephony system logs for any unusual access attempts or changes.
Use automated alerts to detect and report suspicious activities that might indicate unauthorised access.
Keep it running
Enforce authentication and role-based authorisation for phone registration/provisioning, admin changes and voicemail access; regularly review accounts, roles and logs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The user authentication policy for IP telephony systems.
Look at
The document to ensure it includes details on how users are authenticated.
Good evidence
A clear policy outlining the authentication process, including password requirements and MFA.
- Check 2 of 5What an auditor asks for
Look at
The list to ensure it matches the current employee register.
Good evidence
The list is up-to-date with no former employees listed.
- Check 3 of 5What an auditor asks for
Ask for
Logs of recent access attempts to the IP telephony system.
Look at
The logs for any failed or suspicious login attempts.
Good evidence
The logs show legitimate access patterns with minimal failed attempts.
- Check 4 of 5What an auditor asks for
Look at
The dates and attendance records to ensure regular and comprehensive training.
Good evidence
Training is conducted quarterly and participation is documented.
- Check 5 of 5What an auditor asks for
Ask for
The recent security review report of the IP telephony system.
Look at
The report to check that it covers authentication issues and any noted irregularities are addressed.
Good evidence
The report includes all findings and records of any actions taken.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.3.
ISM-0555 mandates authentication and authorisation for IP telephony actions such as device registration and voicemail access. Annex A 8.3 globally enforces access restrictions in line with organisational policies, encompassing IP telephony systems like those in ISM-0555.
This control partially overlaps A.5.17.
ISM-0555 requires authentication and authorisation for all actions on an IP telephony network, including device registration and voicemail access. Annex A 5.17 supports controlled management of authentication information used by IP telephony users and administrators, aligning with ISM-0555's enforcement focus.
This control partially overlaps A.5.18.
ISM-0555 requires authentication and authorisation for IP telephony actions such as user registration, setting changes, and voicemail access. Annex A 5.18 requires provisioning, reviewing, and removal of access rights, including telephony roles, aligning with ISM-0555's enforcement at the point of action.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-MF-ML2.3.
ISM-0555 requires authentication and authorisation for all actions on an IP telephony network (e.g. registering phones, changing users/settings, accessing voicemail). E8-MF-ML2.3 enhances authentication by requiring phishing-resistant MFA for users of online services, including IP telephony administrative portals or voicemail services. ISM-0555 is comprehensive, covering authN/authZ for all telephony actions, not just MFA.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.