SC.L2-3.13.14
Voice over Internet Protocol
Requirement
Assessment objectives
An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.
Determine if:
- ause of Voice over Internet Protocol (VoIP) technologies is controlled; and
- buse of Voice over Internet Protocol (VoIP) technologies is monitored.
From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.
How to implement
Treat your phone system like any other IT system. Decide which VoIP services are approved (for example Teams Phone, Zoom Phone, RingCentral or an on-premises PBX), prohibit the rest for company business, configure the approved one securely (encryption, voicemail PINs, admin MFA, patching, calling restrictions) and watch its logs for misuse such as toll fraud, unknown devices or admin changes. If CUI is discussed on calls or left in voicemails, recordings and transcripts, the service holding them is part of your CUI environment.
- 1PolicyDefine approved VoIP technologies and their permitted use in an acceptable use policy: which phone system and softphone apps are approved, that consumer calling apps are not used for company business, whether call recording and voicemail transcription are allowed, and that new users sign the policy before a line is provisioned [a].[a]
- 2TechnicalConfigure the approved solution securely: signaling and media encryption (SIP over TLS and SRTP for on-premises or SIP-trunk systems; cloud services encrypt by default), voicemail PINs required, default passwords on desk phones and their web interfaces changed, MFA for phone system administrators, international and premium-rate calling restricted to those who need it, and desk phones on a separate voice VLAN [a].[a]
- 3
- 4TechnicalMonitor use: send phone system admin audit logs and call detail records to your log platform or review them in the admin portal, alert on unusual international or after-hours calling and admin changes, and use firewall application control or DNS filtering to detect unapproved VoIP services on company networks and devices [b].[b]
- 5ProcessReview VoIP logs and call reports at least monthly and the list of provisioned lines and devices quarterly (remove lines for departed users, unknown registered devices); record the reviews.[b]
Evidence to collect
Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.
VoIP acceptable use policy and signatures[a]
policy · reviewed annually; signature for every current user
Approved policy naming the approved VoIP solutions and permitted uses, with user acknowledgments.
VoIP security configuration[a]
configuration export · current configuration
Screenshots or exports of encryption settings, voicemail PIN policy, admin MFA, calling restrictions and voice VLAN configuration.
Patch or update history for the PBX, desk phone firmware and softphone apps from the patch tool or provider portal.
VoIP monitoring logs and alerts[b]
log · dated within 90 days
Admin audit log and call detail record exports, alert samples, and firewall reports showing unapproved VoIP application detections.
VoIP review records[b]
record · most recent quarter
Dated monthly log review notes and quarterly line and device reviews with removals.
How assessors check
- Examine
- VoIP policy and acceptable use agreements, phone system configuration, patch records, audit logs, call reports and monitoring records.
- Interview
- The phone system administrator or provider contact, and users about which calling tools they use.
- Test
- Show that a phone system admin sign-in requires MFA; show voicemail requires a PIN; show encryption enabled in the system or provider settings; show the most recent call report review and an example of an unapproved VoIP detection or block.
Tools and products
Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.
Per-user add-on (included in E5/G5); stays inside a GCC or GCC High tenant alongside your other CUI services.
Per-user pricing; Zoom for Government is the FedRAMP-authorized edition to use where calls or recordings may involve CUI.
Common small-business phone system with admin MFA, audit trail and call reports; check its FedRAMP Marketplace listing before relying on it for CUI.
Free open-source PBX; supports TLS and SRTP and logging, but you must patch and harden it yourself.
Usually part of the firewall security subscription; detects and blocks unapproved VoIP apps on company networks.
Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.
Common pitfalls
- Leaving the phone system out of scope entirely because 'it is the phone company's job'.
- Desk phone web interfaces with factory default passwords on the same network as CUI systems.
- No calling restrictions, so a compromised extension runs up international toll-fraud charges.
- Voicemail transcripts or call recordings containing CUI stored in a service with no FedRAMP authorization.
Platform notes
Microsoft 365 (GCC / GCC High)
Teams Phone is available in GCC and GCC High; check which PSTN options (Calling Plans, Direct Routing, Operator Connect) are offered in your cloud. Use Teams calling policies and voicemail settings for control, and the Teams admin center call analytics plus Purview audit log for monitoring.
Google Workspace
Google Voice is managed in the admin console with per-user licensing, call reports and audit logs; confirm whether it is within the authorization scope you rely on before using it for CUI conversations or voicemail.
On-premises or MSP-managed
For an on-premises or hosted PBX, require TLS and SRTP, a voice VLAN, firmware patching, fail2ban or equivalent protection on SIP, and syslog to your log platform. Ask the MSP or VoIP provider for monthly call detail records and admin change logs.
Related practices: SC.L2-3.13.1, SC.L2-3.13.8, SC.L2-3.13.12, AU.L2-3.3.1, SI.L2-3.14.1, CM.L2-3.4.1
Editorial implementation guidance published November 2, 2026. It is not part of the official requirement and does not replace the assessment guide.
Crosswalk
Full crosswalkThe NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports.
NIST SP 800-171 Rev 2
3.13.14SP 800-171 Rev 3
03.13.14withdrawn (NIST: Technology-specific.)SP 800-53 Rev 4
SC-19SP 800-53 Rev 5
SC-19DHow these were reachedHide how these were reached
- SC-19 · Voice Over Internet Protocol · withdrawn in Rev 5 with no successor
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 SC-19 → 800-53 Rev 5 SC-19
Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. NIST also names this Rev 3 requirement as the successor of other withdrawn requirements: open “How these were reached” under the Rev 5 controls for which, in NIST's words.
Where each link comes from (4 links from 4 official documents)
32 CFR Part 170 Office of the Federal Register / GPO
- SC.L2-3.13.14 → 3.13.14“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)
Further discussion
Practice guide notes
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control and monitor Voice over Internet Protocol technologies.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator responsible for the VoIP system. You configure VoIP for new users after being notified that they have signed the Acceptable Use Policy for VoIP technology [a]. You verify that the VoIP solution is configured to use encryption and have enabled requirements for passwords on voice mailboxes and on phone extension management. You require phone system administrators to log in using multifactor authentication when managing the system [a]. You add the VoIP software to the list of applications that are patched monthly as needed [a,b]. Finally, you configure the VoIP system to send logs to your log aggregator so that they can be correlated with those from other systems and examined for signs of suspicious activity [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing VoIP; VoIP usage restrictions; VoIP implementation guidance; system security plan; system design documentation; system audit logs and records; system configuration settings and associated documentation; system monitoring records; other relevant documents or records
Common mistakes
Treating internet-based telephony as unrelated to system security.
Track this in a workspace
The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Source: DoD CIO · https://dodcio.defense.gov/CMMC/