Off-hook Audio Protection Using Push-to-Talk Devices
In SECRET and TOP SECRET areas, special handsets or headsets are used to prevent unintended audio transmission.
Plain language
In areas where sensitive information is handled, using special handsets or headsets that require you to press a button to speak helps prevent accidental eavesdropping. This matters because if your phone or headset transmits sound without you knowing, confidential conversations could be overheard, leading to information leaks.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Nov 2024
Control Stack last updated
19 Mar 2026
E8 maturity levels
N/A
Guideline
Guidelines for communications systemsSection
Telephone systemsOfficial control statement
In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.
Why it matters
Without push-to-talk handsets/headsets, off-hook audio in SECRET/TOP SECRET areas may be transmitted unintentionally, allowing eavesdropping and disclosure of classified discussions.
Operational notes
Ensure push-to-talk handsets/headsets are fitted in SECRET/TOP SECRET areas; test PTT and off-hook behaviour routinely and replace faulty units promptly to prevent unintended audio transmission.
Implementation tips
- IT team should procure push-to-talk handsets or headsets: Work with suppliers to obtain devices that have a button you need to press to transmit audio, ensuring compliance with off-hook audio protection requirements.
- System administrators should configure and test devices: Set up the push-to-talk devices in such a way that they connect properly to your existing phone system. Test the setup to make sure conversations can't be accidentally overheard.
- Office managers should train staff: Organise a short training session for staff who will use these devices, showing them how to correctly press the button when they want to talk and the importance of using these devices in sensitive conversations.
- Security officers should regularly check device usage: Perform routine checks to confirm that staff are using the push-to-talk features correctly and consistently, ensuring no accidental audio transmission.
- Internal auditors should review procurement records: Verify that only authorised push-to-talk devices are purchased and issued specifically for use in SECRET and TOP SECRET areas to maintain security standards.
Audit / evidence tips
- AskProcurement records for push-to-talk devices: Request the documentation that lists the types and quantities of devices purchased GoodRecords showing approved models and supplier compliance with security requirements
- AskTraining records for staff using push-to-talk devices: Request evidence of training sessions conducted for staff GoodAttendance records showing all relevant staff have completed the training and materials that cover secure device use
- AskConfiguration logs or settings: Request any setup documentation related to the push-to-talk devices GoodDocumentation showing tested settings that prevent accidental audio transmission
- AskSecurity inspection reports: Request the results of any internal audits or checks on the use of push-to-talk devices GoodReports confirming correct and consistent use of devices with no security breaches noted
- AskMaintenance and testing logs: Request records showing regular maintenance and functionality tests on the devices GoodLogs indicating regular testing, prompt resolution of issues, and ongoing device effectiveness
Cross-framework mappings
How ISM-0931 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
| layers Partially meets (1) expand_less | ||
| Annex A 7.6 | ISM-0931 requires that, in SECRET and TOP SECRET areas, push-to-talk handsets or headsets are used to meet off-hook audio protection requ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.