STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

An IP-based VTC system implementing a single CODEC that supports conferences on multiple networks with different classification levels (i.e., unclassified, SECRET, TOP SECRET, TS-SCI) must support Periods Processing by being sanitized of all information while transitioning from one period/network to the next.

DISA Rule

SV-259892r1173863_rule

Vulnerability Number

V-259892

Group Title

SRG-VOIP-000120

Rule Version

SRG-VOIP-000120

Severity

CAT II

CCI(s)

• CCI-002204 - Defines the security or privacy policy which prohibits the transfer of unsanctioned information between different security domains.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Obtain equipment that has an automatic capability to sanitize memory or implement and document a manual procedure.

Implement the automatic capability or manual procedure to sanitize all information while transitioning from one period/network to the next.

Check Contents

Verify an automatic capability exists and review documentation to determine if this capability is being implemented before transitioning from one period/network to the next.

If no automatic capability exists, review organizational documentation to determine if a manual procedure is specified and implemented before transitioning from one period/network to the next.

Coordinate with the vendor/solutions provider and certifier to verify all residual information is sanitized based on equipment make and model.

If an automatic capability exists and is being implemented, this is not a finding.

If an automatic capability exists but is not being implemented, this is a finding unless a manual procedure is specified and is being implemented.

If a manual procedure is specified and is being implemented, this is not a finding.

If no procedure is specified or none is being implemented, this is a finding.

Vulnerability Number

V-259892

Documentable

False

Rule Version

SRG-VOIP-000120

Severity Override Guidance

Verify an automatic capability exists and review documentation to determine if this capability is being implemented before transitioning from one period/network to the next.

If no automatic capability exists, review organizational documentation to determine if a manual procedure is specified and implemented before transitioning from one period/network to the next.

Coordinate with the vendor/solutions provider and certifier to verify all residual information is sanitized based on equipment make and model.

If an automatic capability exists and is being implemented, this is not a finding.

If an automatic capability exists but is not being implemented, this is a finding unless a manual procedure is specified and is being implemented.

If a manual procedure is specified and is being implemented, this is not a finding.

If no procedure is specified or none is being implemented, this is a finding.

Check Content Reference

M

Target Key

5585