Navigate

• Top
• Description
• Related
• Enhancements
• CCIs

SC-19

SC-19: Voice Over Internet Protocol

The organization:

• SC-19a.: Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and

• SC-19b.: Authorizes, monitors, and controls the use of VoIP within the information system.

Supplemental

None

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-19.

Control	Description
CM-6	The organization: CM-6a.: Establishes and documents configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; CM-6b.: Implements the configuration settings; CM-6c.: Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and CM-6d.: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
SC-7	The information system: SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
SC-15	The information system: SC-15a.: Prohibits remote activation of collaborative computing devices with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed]; and SC-15b.: Provides an explicit indication of use to users physically present at the devices.

Enhancements

The controls below (if any) add on to the requirements of SC-19.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-19.

CCI	Definition
CCI-001173	The organization establishes usage restrictions for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001174	The organization establishes implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
CCI-001175	The organization authorizes the use of VoIP within the information system.
CCI-001176	The organization monitors the use of VoIP within the information system.
CCI-001177	The organization controls the use of VoIP within the information system.