CMMCpedia
Work with me

Requirements / System and Communications Protection (SC)

SC.L2-3.13.14

Voice over Internet Protocol

Official Source Material

SPRS score value
1 point.
POA&M eligibility
Eligible at a conditional assessment.
Level 1
Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

Determine if:

  1. [a] use of Voice over Internet Protocol (VoIP) technologies is controlled; and
  2. [b] use of Voice over Internet Protocol (VoIP) technologies is monitored.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This covers voice as network traffic, not the copper phone line.

Plain telephone service is outside this requirement. VoIP is data on a network and gets treated like any other protocol. A true no-VoIP environment can assess this requirement as not applicable. But Teams, Zoom, and softphones are VoIP technologies, so no VoIP at all is rarely true. State what you run and how it is controlled.

Control is naming the approved service. Monitoring is watching its traffic.

Authorize the VoIP solution in policy and configuration, and restrict use to the approved product [a]. Monitor through its logs, and watch your network monitoring for voice traffic that is not the approved service [b]. Patching the VoIP software with the rest of the fleet under SI.L2-3.14.1 is part of controlling it.

Keep CUI out of the phone system rather than pulling the phone system into scope.

Segment VoIP from the environment holding CUI, and prohibit CUI discussion over it in policy and training. When a voice conversation about CUI must happen, use a service authorized to carry CUI, such as Teams in GCC High. State compliance through separation in your system security plan instead of arguing the requirement away.

Over-engineering

  • A voice recording and inspection platform. Objectives [a] and [b] are the approved service named in writing and its traffic watched with what you already run.
  • A separate voice network built for compliance. Keeping CUI out of the phone system costs less than bringing the phone system into scope.