STIGQter STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:

Critical network equipment must be redundant and in geographically diverse locations for a site supporting command and control (C2) users.

DISA Rule

SV-259918r948764_rule

Vulnerability Number

V-259918

Group Title

SRG-VOIP-000380

Rule Version

SRG-VOIP-000380

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Implement and document critical network equipment as redundant and in geographically diverse locations for a site supporting C2 users. Critical network equipment includes CERs, SBCs, and session controllers (or Soft Switches in combination with session controllers).

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Check Contents

Review site documentation to confirm critical network equipment is redundant and in geographically diverse locations for a site supporting C2 users.

Verify redundant sets of CERs, SBCs, and session controllers are housed in geographically diverse facilities within the site so that if one location is lost or isolated from the network, communications service is maintained. Site facilities with a Soft Switch should have a session controller implemented in a geographically diverse location.

If critical network equipment does not have redundant equipment, this is a finding.

If redundant critical network equipment is not in a geographically diverse location, this is a finding.

If it is determined, following a cost/benefit study and risk analysis, that redundant facilities containing dual sets of CERs, SBCs, and session controllers are not warranted for the given site, this requirement should be marked as a finding with a justification included in the POA&M stating the authorizing official (AO) is cognizant of and accepts the risk.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Vulnerability Number

V-259918

Documentable

False

Rule Version

SRG-VOIP-000380

Severity Override Guidance

Review site documentation to confirm critical network equipment is redundant and in geographically diverse locations for a site supporting C2 users.

Verify redundant sets of CERs, SBCs, and session controllers are housed in geographically diverse facilities within the site so that if one location is lost or isolated from the network, communications service is maintained. Site facilities with a Soft Switch should have a session controller implemented in a geographically diverse location.

If critical network equipment does not have redundant equipment, this is a finding.

If redundant critical network equipment is not in a geographically diverse location, this is a finding.

If it is determined, following a cost/benefit study and risk analysis, that redundant facilities containing dual sets of CERs, SBCs, and session controllers are not warranted for the given site, this requirement should be marked as a finding with a justification included in the POA&M stating the authorizing official (AO) is cognizant of and accepts the risk.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Check Content Reference

M

Target Key

5585