OpenControls Logo

STIG Viewer

STIGViewer Support

Customers of the DISN VoSIP service must use address blocks assigned by the DRSN/VoSIP PMO.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-259904SRG-VOIP-000240SV-259904r1173930_ruleCCI-003963low
Description
Ensure different, dedicated, address blocks or ranges are defined for the VVoIP system within the LAN (Enclave) that are separate from the address blocks/ranges used by the rest of the LAN for non-VVoIP system devices, thus allowing traffic and access control using firewalls and router ACLs. NOTE: This is applicable to a classified LAN connected to a classified WAN (such as the SIPRNet). In the case of a classified WAN where networkwide address-based accountability or traceability is required by the network PMO, the PMO must provide segregated, networkwide address block(s) so the attached classified LANs can meet this requirement. DISA provides a worldwide VoIP-based voice communications service called the DISN Voice over Secret IP (VoSIP). This service is managed by the DRSN PMO. This service also provides gateways into the DRSN. In support of the above requirement, the SIPRNet PMO has designated specific dedicated address ranges for use by the DISN VoSIP service and assigned these address blocks to the DRSN/VoSIP PMO for VoSIP address management and assignment. The VoSIP service provides VoIP-based communications between VoIP systems within the customer's classified LANs (C-LANs) operating at the secret level while using the SIPRNet WAN for the inter-enclave (inter-LAN) transport. Additionally, the SIPRNet PMO requires networkwide address-based accountability or traceability based on assigned IP address. The customer's SIPRNet-connected secret C-LANs use addresses assigned by the SIPRNet PMO. Therefore, customers of the DISN VoSIP service must use IP addresses assigned to them by the DRSN/VoSIP PMO when addressing the VoIP controllers and endpoints within their C-LANs. This is to maintain the segregation of the voice and data environments on the customer's secret C-LANs as required by this SRG. This also facilitates proper routing and flow control over the traffic between VoSIP addresses. The DISN service is designated DISN Voice over Secret IP but uses an acronym (VoSIP), which also means Voice over Secure IP. Voice over Secure IP relates to any VoIP-based service on a secure or classified IP network. While the DISN VoSIP service is the preferred means to interconnect SIPRNet-connected secret C-LANs for VoIP service, there may be a need for an organization to implement a VoIP-based voice or video communications system within their organization or with close partners. If such a system has no need or potential need to communicate with other enclaves that use the DISN VoSIP service, they must use their own dedicated IP address space carved out of the address space assigned to their C-LANs by the SIPRNet PMO.
STIGDate
Enterprise Voice, Video, and Messaging Policy Security Requirements Guide2025-12-23

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-02Asset Inventories
1.00
CFG-01Configuration Management Program
1.00
TPM-01.1Third-Party Inventories
1.00
AST-02.3Component Duplication Avoidance
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-8System Component Inventory
1.00
NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-003963
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

ID.AM-01
1.00
ID.AM-02
1.00
PR.PS-01
1.00
ID.AMAsset Management
0.50

Who does this work

10 NICE work roles and 8 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-259904r1173930_chk)

Verify customers of the DISN VoSIP service use IP addresses assigned to them by the DRSN/VoSIP PMO when defining the required dedicated address space for the VoIP controllers and endpoints within their secret C-LANs. NOTES: - This is similarly applicable to other classified DISN services and customer's C-LANs. - This is not a requirement if a VoIP-based VVoIP communications system operated in a secret C-LAN has no need or potential need to use the worldwide DISN VoSIP service or to access the DRSN and communicate with other enclaves that do use the DISN service or have access to the DRSN. They must use their own dedicated IP address space carved out of the address space assigned to their C-LANs by the SIPRNet PMO. - This requirement does not directly apply to dedicated hardware-based IP - VTC systems using the C-LAN and SIPRNet for transport, although there may be similar requirements to address this technology in the future. Determine the following: - Is the organization's secret C-LAN connected to SIPRNet? - Does the organization's secret C-LAN support VVoIP communications (not dedicated IP-based VTC)? - Does organization's secret C-LAN VVoIP system interconnect with other enclaves using the DISN VoSIP service? - What address blocks are dedicated to the VVoIP system on the C-LAN? - Is there documented evidence that the DRSN/VoSIP PMO assigned these addresses to the organization, or can such assignment be validated by other means? If the organization's secret C-LAN supports VVoIP communications (not dedicated IP-based VTC) AND is connected to SIPRNet AND uses the DISN VoSIP service BUT DOES NOT use the DRSN/VoSIP PMO assigned address blocks when addressing all of the VVoIP system components, this is a finding.

Fix Text (F-63542r946632_fix)

Ensure customers of the DISN VoSIP service use IP addresses assigned to them by the DRSN/VoSIP PMO when defining the required dedicated address space for the VoIP controllers and endpoints within their secret C-LANs. NOTES: - This is similarly applicable to other classified DISN services and customer's C-LANs. - This is not a requirement if a VoIP-based VVoIP communications system operated in a secret C-LAN has no need or potential need to use the worldwide DISN VoSIP service or to access the DRSN and communicate with other enclaves that do use the DISN service or have access to the DRSN. They must use their own dedicated IP address space carved out of the address space assigned to their C-LANs by the SIPRNet PMO. - This requirement does not directly apply to dedicated hardware-based IP - VTC systems using the C-LAN and SIPRNet for transport, although there may be similar requirements to address this technology in the future. Obtain and assign IP addresses as provided by the DRSN PMO-VoSIP department when defining the required dedicated address space on the LAN.