SC-19 Voice Over Internet Protocol is withdrawn in Revision 5. Its remaining text is one sentence: technology specific, addressed as any other technology or protocol. The catalog does not name a replacement control.
NIST SP 800-53 binds US federal systems, and reaches contractors and cloud providers through contract terms such as FedRAMP. For everyone else it is a reference catalog.
What it means in practice
NIST stopped writing special rules for VoIP. Your hosted phone system, softphones and meeting tools get the same treatment as every other system. That means the general controls apply: encryption of traffic in transit (SC-8), access control, logging, and configuration management.
One more point. Voice traffic has a few special properties. Calls are real time, so teams sometimes relax encryption to avoid jitter, and call recordings can contain card numbers or health details. Treat the recording store like any other data store with sensitive content. Apply retention limits and access control, and keep the vendor's own security documentation on file because most voice platforms are hosted.
Evidence to collect
- The inventory entry for each voice or meeting platform, with an owner.
- Proof that traffic is encrypted in transit, such as vendor documentation or a configuration screenshot.
- Account lists and the multifactor setting for admin users.
- Log retention settings for call records and admin actions.
Common gaps
Voice systems often sit outside the asset inventory because telecom or facilities bought them. They also tend to have shared admin accounts that nobody reviews.
How to implement it
Add voice and meeting platforms to your inventory. Put them in the same access review and vendor review cycles as the rest of your stack. If an auditor asks about SC-19, say it is withdrawn and show those records.
Quick check
Does SC-19 still need its own evidence?
No. It is withdrawn. Show that voice systems are covered by your general encryption, access and logging controls.
