STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026: STIGQter: STIG Summary: Enterprise Voice, Video, and Messaging Policy Security Requirements Guide Version: 1 Release: 4 Benchmark Date: 05 Jan 2026:SV-259926r948772_rule
V-259926
SRG-VOIP-000460
SRG-VOIP-000460
CAT III
10
Ensure a UPS system is provided for all parts of the VVoIP infrastructure, including the core LSC/MFSS, adjunct systems providing critical services, SBC, CER, LAN elements, and endpoints. All VVoIP system devices, including portions of the LAN supporting non-C2 users, are provided at least 15 minutes of UPS in support of emergency life safety and security communications during a power failure.
NOTE: The 15 minutes of UPS mandated by this requirement is a minimum. Backup times of 30 to 60 minutes are preferred. UPS systems supplying power to infrastructure supporting non-C2 users should also support environmental power to prevent equipment failures.
Inspect the VVoIP system design for evidence of continuous backup power to the infrastructure and command and control users.
Verify a UPS system is provided for all parts of the VVoIP infrastructure, including the core Local Session Controller (LSC)/Multifunction Soft Switch (MFSS), adjunct systems providing critical services, SBC, CER, LAN elements, and endpoints as follows:
- All VVoIP system devices, including portions of the LAN that supports non-C2 users, are provided 15 minutes of UPS in support of emergency life safety and security communications during a power failure.
- In no case should a UPS system immediately, or within a short time, drop power to the supported equipment when primary power is removed. This would indicate an undersized or defective UPS unit.
Determine if the infrastructure assets being reviewed support non-C2 users.
If non-C2 users are supported and 15 minutes of backup power is not provided for LAN Infrastructure, WAN boundary, VVoIP infrastructure, and VVoIP endpoints for emergency life safety and security calls, this is a finding.
NOTE: The requirement for UPS support to non-C2 user communications is negated when these users have an alternate reliable means of communicating in such situations. A suitable alternative would be a policy and standard operating procedure in effect requiring users to evacuate the facility to a location where mobile communications capability is available and acceptable.
V-259926
False
SRG-VOIP-000460
Inspect the VVoIP system design for evidence of continuous backup power to the infrastructure and command and control users.
Verify a UPS system is provided for all parts of the VVoIP infrastructure, including the core Local Session Controller (LSC)/Multifunction Soft Switch (MFSS), adjunct systems providing critical services, SBC, CER, LAN elements, and endpoints as follows:
- All VVoIP system devices, including portions of the LAN that supports non-C2 users, are provided 15 minutes of UPS in support of emergency life safety and security communications during a power failure.
- In no case should a UPS system immediately, or within a short time, drop power to the supported equipment when primary power is removed. This would indicate an undersized or defective UPS unit.
Determine if the infrastructure assets being reviewed support non-C2 users.
If non-C2 users are supported and 15 minutes of backup power is not provided for LAN Infrastructure, WAN boundary, VVoIP infrastructure, and VVoIP endpoints for emergency life safety and security calls, this is a finding.
NOTE: The requirement for UPS support to non-C2 user communications is negated when these users have an alternate reliable means of communicating in such situations. A suitable alternative would be a policy and standard operating procedure in effect requiring users to evacuate the facility to a location where mobile communications capability is available and acceptable.
M
5585