ISM control lookup / Topic

Guidelines for communications systems

33 controls · September 2026 edition

• ISM-0229 · Personnel awareness

  Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems.

• ISM-0230 · Personnel awareness

  Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.

• ISM-0231 · Personnel awareness

  When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made.

• ISM-0232 · Protecting conversations

  Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.

• ISM-0233 · Cordless telephone systems

  Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted using ASD-approved cryptography.

• ISM-0235 · Speakerphones

  Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room.

• ISM-0236 · Off-hook audio protection

  Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.

• ISM-0245 · Connecting multifunction devices to digital telephone systems

  MFDs are not connected to digital telephone systems.

• ISM-0546 · Video-aware and voice-aware firewalls and proxies

  When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used.

• ISM-0547 · Protecting video conferencing and Internet Protocol telephony traffic

  Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.

• ISM-0548 · Protecting video conferencing and Internet Protocol telephony traffic

  Video conferencing and IP telephony calls are established using a secure session initiation protocol.

• ISM-0549 · Traffic separation

  Video conferencing and IP telephony traffic is physically or logically separated from other data traffic.

• ISM-0551 · Video conferencing unit and Internet Protocol phone authentication

  IP telephony is configured such that:

• ISM-0553 · Video conferencing unit and Internet Protocol phone authentication

  Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings.

• ISM-0554 · Video conferencing unit and Internet Protocol phone authentication

  An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.

• ISM-0555 · Video conferencing unit and Internet Protocol phone authentication

  Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail.

• ISM-0556 · Traffic separation

  Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.

• ISM-0558 · Internet Protocol phones in public areas

  IP phones used in public areas do not have the ability to access data networks, voicemail and directory services.

• ISM-0559 · Microphones and webcams

  Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.

• ISM-0588 · Multifunction device usage policy

  An MFD usage policy is developed, implemented and maintained.

• ISM-0589 · Scanning and copying documents on multifunction devices

  MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to.

• ISM-0590 · Authenticating to multifunction devices

  Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.

• ISM-0931 · Off-hook audio protection

  In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.

• ISM-1014 · Video conferencing unit and Internet Protocol phone authentication

  Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.

• ISM-1019 · Denial of service response plan

  A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.

• ISM-1036 · Observing multifunction device use

  MFDs are placed in areas where their use can be observed.

• ISM-1078 · Telephone system usage policy

  A telephone system usage policy is developed, implemented and maintained.

• ISM-1450 · Microphones and webcams

  Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas.

• ISM-1562 · Video conferencing and Internet Protocol telephony infrastructure hardening

  Video conferencing and IP telephony infrastructure is hardened.

• ISM-1805 · Denial of service response plan

  A denial of service response plan for video conferencing and IP telephony services contains the following:

• ISM-1854 · Authenticating to multifunction devices

  Human users authenticate to MFDs before they can print, scan or copy documents.

• ISM-1855 · Logging multifunction device use

  Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged.

• ISM-2075 · Sending and receiving fax messages

  Fax machines, and online fax services, are not used for sending or receiving fax messages.