ASD ISM 0931 Off-hook audio protection using push-to-talk devices
What it says
In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIn SECRET and TOP SECRET areas, special handsets or headsets are used to prevent unintended audio transmission.
In areas where sensitive information is handled, using special handsets or headsets that require you to press a button to speak helps prevent accidental eavesdropping. This matters because if your phone or headset transmits sound without you knowing, confidential conversations could be overheard, leading to information leaks.
Free. Save your status, tasks and notes.
Why it matters
Without push-to-talk handsets/headsets, off-hook audio in SECRET/TOP SECRET areas may be transmitted unintentionally, allowing eavesdropping and disclosure of classified discussions.
How to implement
IT team should procure push-to-talk handsets or headsets: Work with suppliers to obtain devices that have a button you need to press to transmit audio, ensuring compliance with off-hook audio protection requirements.
System administrators should configure and test devices: Set up the push-to-talk devices in such a way that they connect properly to your existing phone system.
Test the setup to make sure conversations can't be accidentally overheard.
Office managers should train staff: Organise a short training session for staff who will use these devices, showing them how to correctly press the button when they want to talk and the importance of using these devices in sensitive conversations.
Security officers should regularly check device usage: Perform routine checks to confirm that staff are using the push-to-talk features correctly and consistently, ensuring no accidental audio transmission.
Internal auditors should review procurement records: Verify that only authorised push-to-talk devices are purchased and issued specifically for use in SECRET and TOP SECRET areas to maintain security standards.
Keep it running
Ensure push-to-talk handsets/headsets are fitted in SECRET/TOP SECRET areas; test PTT and off-hook behaviour routinely and replace faulty units promptly to prevent unintended audio transmission.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Procurement records for push-to-talk devices: Request the documentation that lists the types and quantities of devices purchased.
Look at
Devices that meet the required security specifications for off-hook protection.
Good evidence
Records showing approved models and supplier compliance with security requirements.
- Check 2 of 5What an auditor asks for
Ask for
Training records for staff using push-to-talk devices: Request evidence of training sessions conducted for staff.
Look at
Attendance logs and training materials to ensure comprehensiveness.
Good evidence
Attendance records showing all relevant staff have completed the training and materials that cover secure device use.
- Check 3 of 5What an auditor asks for
Ask for
Configuration logs or settings: Request any setup documentation related to the push-to-talk devices.
Look at
Technical details that confirm correct setup and integration with phone systems.
Good evidence
Documentation showing tested settings that prevent accidental audio transmission.
- Check 4 of 5What an auditor asks for
Ask for
Security inspection reports: Request the results of any internal audits or checks on the use of push-to-talk devices.
Look at
Notes on any misuse or non-compliance and actions taken to address these.
Good evidence
Reports confirming correct and consistent use of devices with no security breaches noted.
- Check 5 of 5What an auditor asks for
Ask for
Maintenance and testing logs: Request records showing regular maintenance and functionality tests on the devices.
Look at
Frequency of checks and any issues identified with their resolution.
Good evidence
Logs indicating regular testing, prompt resolution of issues, and ongoing device effectiveness.
Mappings
Closest match in ISO/IEC 27001: A.7.6, Security measures for working in secure areas, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.6.
ISM-0931 requires that, in SECRET and TOP SECRET areas, push-to-talk handsets or headsets are used to meet off-hook audio protection requirements and prevent unintended audio transmission. This relates to ISO/IEC 27001:2022 Annex A 7.6 because push-to-talk audio controls are a specific security measure that can be implemented when working in secure areas. Annex A 7.6 is broader and can include many other secure-area measures (e.g. entry controls, device restrictions, clear desk), whereas ISM-0931 focuses specifically on mitigating inadvertent audio eavesdropping risks from telephony/headset use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.