ASD ISM 1014 Implement individual logins for secure IP phone use
What it says
Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure each user has a unique login when using IP phones for secret conversations.
This control means making sure each person using an IP phone for a confidential chat has their own unique login. Without this, anyone could listen in on private conversations, risking leaks of sensitive information that could harm your business or client trust.
Free. Save your status, tasks and notes.
Why it matters
If IP phones used for SECRET/TOP SECRET calls lack individual logins, users can't be verified, enabling unauthorised use and weakening call accountability.
How to implement
The IT team should set up individual user accounts for each employee using IP phones.
This means creating a unique username and password for each person based on their organisational role and authorising these through a secure system.
Managers should ensure that staff are trained on how to use their unique logins securely.
This involves conducting brief sessions to explain the importance of keeping login details private and demonstrating how to log in and out properly.
HR should update onboarding and offboarding processes to include steps for issuing and revoking IP phone logins.
New employees should receive their logins upon arrival, and their access should be removed immediately when they leave.
The IT team should regularly review user access to IP phones.
This involves checking logs to ensure that only current employees have active logins and removing any unnecessary accounts.
The system owner should implement a policy that requires regular password changes for IP phone logins.
They can set up the phones to prompt users for a new password every three months, ensuring continued security.
Keep it running
Ensure each secure IP phone has a unique user login, promptly disable departed users, and regularly review account-to-handset assignments for SECRET/TOP SECRET use.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The login policy document: Request to see a written policy outlining the need for individual logins for IP phones.
Look at
Clear rules regarding unique user accounts and secure password practices.
Good evidence
Includes policies dated and signed by management.
- Check 2 of 5What an auditor asks for
Ask for
To see the user account list: Request a current list of all user accounts that can access IP phones.
Look at
The list to ensure each name corresponds with a current employee.
Good evidence
Shows up-to-date accounts with no excess or leftover entries.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request documentation of the training sessions provided to staff on using IP phone logins securely.
Look at
Attendance records and training materials.
Good evidence
Includes recent records of sessions with clear content coverage.
- Check 4 of 5What an auditor asks for
Ask for
To see logs of IP phone access: Request access logs showing who logged into IP phones and when.
Look at
Entries that match current employee IDs and usage patterns.
Good evidence
Includes logs with no suspicious or unauthorised entries.
- Check 5 of 5What an auditor asks for
Ask for
The onboarding and offboarding checklist: Request the checklist used by HR when employees join or leave.
Look at
The items detailing issuance and removal of IP phone logins.
Good evidence
Features a checklist that includes specific actions for managing these logins.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-1014 requires individual logins for IP phones used for SECRET or TOP SECRET conversations to ensure user-specific access and accountability. Annex A 5.15 requires the organisation to establish and implement access control rules and procedures for both physical and logical access based on business and security requirements, under which per-user phone logins would be one concrete control. ISM-1014 is narrower, focusing on a particular asset type (IP phones) and use case (classified conversations), while Annex A 5.15 covers access control more generally across assets and environments.
This control partially meets A.5.17.
ISM-1014 requires individual (unique) logins to be implemented for IP phones used for SECRET or TOP SECRET conversations. Annex A 5.17 governs the allocation and management of authentication information (e.g. issuing, protecting, and handling credentials) across the organisation, which would include credentials used to log into secure IP phones. ISM-1014 is a specific, high-assurance application of credential management focused on classified voice use, whereas Annex A 5.17 is broader and not specific to IP telephony or classification levels.
This control partially meets A.8.5.
ISM-1014 requires individual logins for secure use of IP phones for SECRET or TOP SECRET conversations, implying a need for robust user authentication and traceability. Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions, which provides the general requirement that would encompass authenticating users to an IP phone service. ISM-1014 is a specific instantiation for classified voice endpoints, whereas Annex A 8.5 is broader and technology-agnostic about the authentication method and systems covered.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.