SC.2.014 — Control VoIP Technologies

What SC.2.014 means in plain English

If you use internet-based phone systems like Microsoft Teams calling, Zoom Phone, or a VoIP service, you need to make sure those calls are encrypted and the system is configured securely. VoIP calls can be intercepted if they are not encrypted. Make sure your VoIP system uses encryption (most modern ones do by default), put VoIP traffic on its own VLAN if possible, and have a policy about discussing CUI over VoIP versus regular phone lines. Document what VoIP system you use and how it is secured.

The assessment question

“Do you monitor and control VoIP usage by ensuring VoIP traffic is encrypted, VoIP devices are on a separate network segment where feasible, and policies exist regarding discussion of CUI over VoIP?”

How to implement SC.2.014

1. Inventory your VoIP systems: document what platform you use (Microsoft Teams, Zoom, RingCentral, on-premises PBX) and verify it supports encryption for voice traffic.
2. Verify encryption is enabled: Microsoft Teams encrypts calls by default. For other providers, check their security settings and confirm TLS/SRTP encryption is active.
3. If using on-premises VoIP phones, configure a separate VLAN for VoIP traffic to prevent snooping from the data network.
4. Write a short policy statement: CUI may only be discussed over encrypted VoIP systems or traditional phone lines — not over unencrypted consumer apps.

Evidence your assessor will ask for

• Inventory of VoIP systems in use with encryption status documented
• VoIP platform configuration showing encryption is enabled (TLS/SRTP)
• Network diagram showing VoIP VLAN segmentation (if applicable)
• Written policy on VoIP usage and CUI discussion restrictions

More System and Communications Protection controls