ASD ISM 1078 Develop and maintain telephone system usage policy
What it says
A telephone system usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and keep a policy for how phones should be used within the organisation.
This control is about making sure your organisation has a clear, up-to-date policy on how employees should use telephones at work. It matters because without guidelines, there can be misuse, like long personal calls or data leaks through unsecured phone conversations. This can lead to increased costs or risk of sensitive information falling into the wrong hands.
Free. Save your status, tasks and notes.
Why it matters
Without a telephone system usage policy, staff may share sensitive data over insecure calls and incur unauthorised call charges, increasing fraud and privacy breach risk.
How to implement
The organisation's management team should draft a telephone system usage policy.
They can start by listing what is acceptable and not acceptable when it comes to using phones at work, like limiting international calls or avoiding discussing confidential information in public spaces. Involve teams like IT and HR to cover technical and behavioural aspects.
HR should communicate this policy to all employees.
They can organise an orientation session or send an email with a clear summary of the policy, ensuring everyone knows what's expected. Include examples so employees can relate to what's permissible and what's not.
IT should implement technical measures that support the policy, like call logging or blocking premium numbers if required.
They can set up tools to monitor phone usage patterns ensuring they align with the policy and alert management to any violations.
Line managers should discuss the policy during team meetings to reinforce its importance.
They can refer to past examples (anonymised, if necessary) where misuse was problematic and the consequences faced to drive home the policy's relevance.
The policy should be reviewed annually by a cross-functional team, including management, HR, and IT.
This team should evaluate if changes in technology or business operations require policy updates, ensuring it remains relevant.
Keep it running
Review phone/PBX logs for unusual calling patterns, define permitted use and recording rules, and update the policy when new telephony or messaging features are introduced.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The written telephone system usage policy: Ensure there is a documented policy that is actively shared with employees.
Look at
Inclusion of key sections like acceptable and unacceptable usage, and guidelines for handling sensitive calls.
Good evidence
Policy is detailed but clear, covering all necessary points without being overly complex.
- Check 2 of 5What an auditor asks for
Ask for
Records of policy communication: This could be emails or attendance records from policy briefings.
Look at
Evidence that all employees were informed about the policy upon its release or update.
Good evidence
Is evidence showing 100% of current employees have received and acknowledged the policy.
- Check 3 of 5What an auditor asks for
Ask for
To see reports of phone usage monitoring: These should show compliance with the restriction measures set by the policy.
Look at
Regular monitoring with documented instances of policy breaches.
Good evidence
Details on when calls fall outside policy norms and action taken thereafter.
- Check 4 of 5What an auditor asks for
Ask for
A list of policy review dates and changes made: Confirm the policy has been reviewed annually or as needed.
Look at
Evidence of regular updates that keep pace with changes in technology or business environment.
Good evidence
Is a documented timeline of reviews showing continuous improvement.
- Check 5 of 5What an auditor asks for
Ask for
To speak with a sample of employees: Verify their understanding of the policy and any concerns they might have.
Look at
Clear awareness and understanding of key policy points among employees.
Good evidence
Result is employees accurately recounting the rules and their purpose.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.1.
ISM-1078 requires a specific topic policy for telephone system usage to be developed, implemented, and maintained. ISO/IEC 27001:2022 Annex A 5.1 establishes the overarching requirement to define, approve, communicate, acknowledge, and periodically review information security policies and topic-specific policies. ISM-1078 fits within Annex A 5.1 as one such topic-specific policy, but does not itself cover the full governance lifecycle elements (e.g., acknowledgement and scheduled review) to the same explicit extent.
This control partially meets A.5.10.
ISM-1078 requires an organisation to develop, implement, and maintain a telephone system usage policy. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which can include telephony/voice systems as an organisational asset. ISM-1078 is a topic-specific instance of acceptable use focused on telephone systems, whereas Annex A 5.10 is broader and covers acceptable use across many asset types.
This control partially overlaps A.5.4.
Annex A 5.4 requires management to ensure personnel comply with the organisation's information security policies and procedures. ISM-1078 mandates a telephone system usage policy, which becomes a topic-specific rule set that management must enforce to achieve compliant behaviour. ISM-1078 is limited to telephone system usage, while Annex A 5.4 is broader and covers enforcement of all applicable policies.
This control depends on A.5.36.
Annex A 5.36 requires regular review of compliance with the organisation's information security policies, topic-specific policies, rules and standards. ISM-1078 requires a telephone system usage policy to be developed, implemented and maintained, providing defined rules against which compliance can be reviewed under Annex A 5.36. ISM-1078 is policy creation/maintenance for one topic, while Annex A 5.36 is the recurring compliance review mechanism.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.