Secure the voice system as both a network and a business process

1. Build the voice-system inventory

• PBX/EPBX model or hosted service, software version and support status
• Trunks, lines, numbers, gateways and provider escalation contacts
• Handsets, softphones, conference devices and remote users
• Voice VLAN, switches, PoE, router, firewall, DNS/NTP and internet dependencies
• Administrative accounts, provisioning methods, backups, logs and call-detail records
• Power, failover and manual continuity paths

2. Apply layered controls

1. Remove or disable default, unused and former-user accounts; use unique strong credentials and MFA where supported.
2. Limit administration to trusted paths and roles; do not expose a management console broadly to the internet.
3. Keep PBX, gateways, handsets and provisioning services on supported releases and verified update channels.
4. Use network segmentation, firewall policy and provider-supported signaling/media protection where the design permits.
5. Restrict destinations, time windows, international or premium calling according to business need and monitor anomalies.
6. Protect configuration backups, voicemail, call records and logs as sensitive business data.

3. Test failure and recovery

Test how reception, critical extensions and external calling behave during internet, power, provider and PBX failures. Keep a documented configuration backup and verify that it can be restored to an appropriate supported environment.

NIST's VoIP guidance is a foundational security reference but is not a current product configuration manual. Apply its architectural risk perspective together with current vendor, provider and standards documentation.