ASD ISM 0556 Ensure traffic separation for video conferencing and telephony
What it says
Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWorkstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.
This control is about keeping your internet-based phone calls and video meetings on a separate path from other data on your networks. It's like making sure your main conversations don't get caught up in traffic with other office communications, reducing risks of eavesdropping or interference that could cause misunderstandings or productivity loss.
Free. Save your status, tasks and notes.
Why it matters
Without VLAN separation between workstations, IP phones and video units, voice/video streams can be intercepted or disrupted, exposing confidential discussions and degrading service.
How to implement
The IT team should set up Virtual Local Area Networks (VLANs) to separate data.
They can do this by configuring network switches to treat video conferencing and IP telephony as distinct, ensuring this data isn't mixed with other types of network traffic.
The system administrator should review the network architecture to identify sections of the network that handle both video calls and workstation data.
Then, they should modify the settings so that these data streams are isolated using VLANs or similar technologies.
Network managers should update policies to include the requirement for traffic separation before installing any new video conferencing equipment.
This policy update ensures that every time new devices are added, they will not compromise the separation of data.
Business managers should ensure the procurement team coordinates with IT when acquiring new conferencing tools.
They need to verify that any new equipment supports VLANs or a similar separation mechanism, which keeps network sections distinct.
The security officer should train staff on recognising the importance of keeping their personal computers off the same network path as their internet calls and video meetings.
This involves hosting informational sessions explaining why separation helps keep communications secure and uninterrupted.
Keep it running
Regularly validate VLAN (or equivalent) separation for IP telephony/video endpoints and workstation ports; review switchport tagging/voice VLAN settings to prevent traffic mixing.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network map that shows physical and virtual network separations.
Look at
The clear delineations between video conferencing/IP telephone traffic and other network data.
Good evidence
Is a detailed diagram showing separate VLANs or equivalent setups dedicated to specific traffic types.
- Check 2 of 5What an auditor asks for
Look at
Clauses that mandate traffic separation.
Good evidence
Includes a stated policy mentioning the use of VLANs or similar methods for data separation.
- Check 3 of 5What an auditor asks for
Ask for
The network device configuration logs.
Look at
The specific settings that segregate voice and video traffic from other information flows.
Good evidence
Shows logs with VLAN ID assignments or similar settings distinct for video and phone traffic.
- Check 4 of 5What an auditor asks for
Ask for
Recent training materials distributed to staff regarding network use.
Look at
The content to confirm information about keeping traffic types separate.
Good evidence
Includes clear guidance on traffic separation practices aligned with organisational policy.
- Check 5 of 5What an auditor asks for
Look at
Discussions or requirements concerning network traffic separation.
Good evidence
Includes emails or meeting notes showing intended support for maintaining traffic boundaries.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.22.
ISM-0556 requires organisations to keep video conferencing and IP telephony traffic separated from other workstation/data traffic using VLANs or similar mechanisms. This relates directly to Annex A 8.22, which requires network segregation between groups of services, users and systems as a general security practice. ISM-0556 is a specific, technology-focused instance of the broader network segregation requirement in Annex A 8.22.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.