STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

IP-based VTC systems implementing a single CODEC that support conferences on multiple networks with different classification levels must sanitize nonvolatile memory while transitioning between networks by overwriting all configurable parameters with null settings before reconfiguring the CODEC for connection to the next network.

DISA Rule

SV-259895r1173866_rule

Vulnerability Number

V-259895

Group Title

SRG-VOIP-000150

Rule Version

SRG-VOIP-000150

Severity

CAT II

CCI(s)

• CCI-002217 - Separate information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Obtain a VTC system that has an automated sanitization capability.

Implement and document a procedure that uses this capability to sanitize the CODEC when transitioning between networks.

As a last resort, implement and document a manual sanitization/reconfiguration procedure to perform this function.

Check Contents

Verify the VTC system has an automated configuration management system configured to sanitize and reconfigure the CODEC when transitioning between networks.

If it does, review documentation to determine if this capability is being implemented. If these conditions are met, this is not a finding.

If the unit is not implementing an automated process, review documentation to determine if a manual procedure is specified and implemented when transitioning between networks. This will result in a CAT III finding if these conditions are met and a CAT II finding if they are not.

If an automatic capability exists but is not being implemented, or an automated configuration management system is not being used, this is a CAT II finding unless a manual procedure is specified and is being implemented. I f a manual procedure is specified and is being implemented, this is a CAT III finding.

If the unit is not being sanitized when transitioning between networks, this is a CAT II finding.

Vulnerability Number

V-259895

Documentable

False

Rule Version

SRG-VOIP-000150

Severity Override Guidance

Verify the VTC system has an automated configuration management system configured to sanitize and reconfigure the CODEC when transitioning between networks.

If it does, review documentation to determine if this capability is being implemented. If these conditions are met, this is not a finding.

If the unit is not implementing an automated process, review documentation to determine if a manual procedure is specified and implemented when transitioning between networks. This will result in a CAT III finding if these conditions are met and a CAT II finding if they are not.

If an automatic capability exists but is not being implemented, or an automated configuration management system is not being used, this is a CAT II finding unless a manual procedure is specified and is being implemented. I f a manual procedure is specified and is being implemented, this is a CAT III finding.

If the unit is not being sanitized when transitioning between networks, this is a CAT II finding.

Check Content Reference

M

Target Key

5585