Navigate

• Top
• Description
• Related
• Enhancements
• CCIs

SC-19

SC-19: Voice Over Internet Protocol

The organization:

• a: Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and

• b: Authorizes, monitors, and controls the use of VoIP within the information system.

Supplemental

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
PR.PT-4

Related Controls

The controls below (if any) were marked by NIST as being related to SC-19.

Control	Description
CM-6	The organization: a: Establishes and documents configuration settings for information technology products employed within the information system using [organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; b: Implements the configuration settings; c: Identifies, documents, and approves any deviations from established configuration settings for [organization-defined information system components] based on [organization-defined operational requirements]; and d: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
SC-7	The information system: a: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b: Implements subnetworks for publicly accessible system components that are [] separated from internal organizational networks; and c: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-15	The information system: a: Prohibits remote activation of collaborative computing devices with the following exceptions: [organization-defined exceptions where remote activation is to be allowed]; and b: Provides an explicit indication of use to users physically present at the devices.

Enhancements

The controls below (if any) add on to the requirements of SC-19.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-19.

CCI	Definition
CCI-001173	The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001174	The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001175	The organization authorizes the use of VoIP within the information system.
CCI-001176	The organization monitors the use of VoIP within the information system.
CCI-001177	The organization controls the use of VoIP within the information system.