NET.4.1 Telecommunications Systems

Prior to the procurement or expansion of a PBX system, a requirements analysis MUST be carried out. This analysis MUST determine the functions the PBX system should offer. In addition to the features of the PBX system, the number of required connections and ports MUST also be determined. Possible expandability and basic security functions MUST also be considered during planning. In addition, support and maintenance contracts for the PBX system MUST be taken into account as required. Based on the requirements determined, the use of the PBX system MUST then be planned and documented. The requirements identified and the plans devised MUST be coordinated with the corresponding persons responsible for IT.

In order to be able to make calls to persons who are not connected to a given organisation's own PBX system, a PBX service provider MUST be contracted. The requirements for the PBX system, the relevant security policy, and contractual and financial aspects MUST be taken into account. All services agreed MUST be specified clearly and concisely in writing.

Suitable data MUST be recorded for PBX systems and evaluated as required. Additionally, all evaluation procedures, data transmissions, data access, and system-related interventions that involve program modifications MUST be logged. All administration work on PBX systems MUST also be logged. The logged information SHOULD be checked regularly.

Organisations SHOULD create a specific security policy for their PBX systems based on their general security policies. PBX security policies SHOULD include basic statements about confidentiality, availability, and integrity. All persons and groups involved in the procurement, design, implementation, and operation of PBX systems SHOULD be familiar with the security policy for PBX systems and use it as the basis for their work. The central security requirements for a given PBX system and the security level to be achieved SHOULD be included in the respective organisation's general security policy.

A PBX system SHOULD be located in a suitable room. The interfaces on the PBX, especially those that are unused, SHOULD be suitably protected.

The scope of available features SHOULD be limited to the necessary minimum. Only the features needed SHOULD be activated. The features not required or deemed critical due to their potential for misuse SHOULD be disabled on the central system to the greatest extent possible. Additional protective safeguards SHOULD be implemented for the confidential data stored on or retrievable from the end devices in use.

Users of PBX systems SHOULD be instructed in the correct use of related services and devices. Users of PBX systems SHOULD be provided with all the required documents regarding the operation of corresponding end devices. Any anomalies and abnormal behaviour of PBX systems SHOULD be reported to the relevant person in charge.

The configurations of PBX systems SHOULD be suitably documented and updated. Such configurations MUST be evaluated at regular intervals. The results of the evaluation SHOULD at least be presented to the Chief Information Security Officer, the Process Owner, and other specifically appointed persons.

The disposal of PBX systems and connected PBX devices SHOULD be considered in an organisation's general security policy. All the data stored on PBX systems or devices SHOULD be securely erased before disposal.

The configuration and application data of PBX systems SHOULD be backed up during their initial setup and then on a regular basis, particularly after modifications. Whether the backups of PBX systems can actually be used as a basis for system recovery SHOULD be regularly checked and documented.

A backup concept SHOULD be drawn up for PBX systems and coordinated with an organisation's general data protection concepts for servers and network components.

The results of requirements analysis and planning SHOULD be factored into the procurement of PBX systems. When procuring a PBX system, the need for both digital and analogue subscriber connections SHOULD be considered. Furthermore, existing communication systems and components SHOULD be taken into account in the procurement process.

A contingency plan SHOULD be drawn up for PBX systems. This SHOULD be integrated in an organisation's contingency concept. Regular emergency drills SHOULD be carried out for PBX systems.

It SHOULD be ensured that emergency calls can be made from a given organisation even in the event of a PBX system failure. The emergency call facilities SHOULD be accessible and sufficiently close to all rooms.

The range of functions of end devices set up in openly accessible rooms SHOULD be restricted. If this is not possible, end devices SHOULD be protected against unauthorised access in a suitable manner.

Devices for maintaining and configuring PBX systems SHOULD be secured with passwords or PINs.

A PBX system SHOULD be located in a separate and suitably secured room. Site and system access to PBX systems SHOULD be restricted to a specific group of people. External staff SHOULD ONLY be able to access PBX systems with supervision.

PBX system connections SHOULD be redundant. An additional PSTN connection SHOULD be available for IP-based PBX systems.