SC-19-727 Voice over Internet Protocol

Voice over Internet Protocol

Control ID

SC-19-727

Control Name

Voice over Internet Protocol

Control Category

System and Communications Protection

Functional Areas

Protect

Sub-Areas

System Communications Protection

NIST Baseline Level(s)

MOD, HIGH

NIST Priority

State Implementation Required

Agency Last Implemented Date

Risk Statement

Users have access to networks that they are not authorized to use.

Control Description

The organization: a. Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and b. Authorizes, monitors, and controls the use of VoIP within the information system.

Control Example

Where in use, access to Voice over Internet Protocol (VoIP) technologies is limited to appropriate personnel.

State Implementation

No statewide control

Testing Procedures

Obtain system and communications protection policy; procedures addressing VoIP; NIST Special Publication 800-58; VoIP usage restrictions; other relevant documents or records and ascertain if: (I)the organization establishes usage restrictions and implementation guidance for Voice over Internet Protocol technologies based on the potential to cause damage to the information system if used maliciously. (ii)the organization authorizes, monitors, and controls the use of VoIP within the information system.