Choosing a VoIP (Voice over Internet Protocol) supplier who follows the National Cyber Security Centre (NCSC) good practice is essential for protecting your business communications. Simply put, this means your phone system provider takes appropriate steps to secure your calls and data against cyber threats, helping to avoid disruptions, data breaches, or loss of customer trust.
For a UK SME, a poorly secured VoIP system can lead to significant downtime if attackers exploit vulnerabilities, potentially halting phone-based sales or customer service. Moreover, sensitive information shared over calls or stored in call logs might be exposed, raising compliance concerns under UK GDPR and the Data Protection Act 2018. Ensuring your VoIP supplier aligns with NCSC guidance helps reduce these risks and supports audit readiness, especially if you pursue Cyber Essentials or ISO 27001 certification.
Consider a typical business with around 50 staff using a VoIP phone system for daily operations. If their supplier neglects strong authentication or fails to keep software patched, attackers could hijack phone lines to make fraudulent calls or intercept conversations. A responsible IT partner would regularly review the supplier's security measures, verify encryption standards, and implement multi-factor authentication (MFA) for access to the management portal. This proactive approach minimises the risk of costly fraud and service interruptions.
How to check if your VoIP supplier meets NCSC good practice
- Ask about security certifications: Does the supplier have Cyber Essentials (or Cyber Essentials Plus) certification? This is a practical baseline for UK SMEs.
- Inquire about encryption: Are calls and signalling encrypted end-to-end using recognised protocols (e.g., TLS, SRTP)?
- Authentication controls: Does the supplier enforce strong password policies and offer MFA for account access?
- Software updates: How often is the VoIP platform updated and patched against known vulnerabilities?
- Access management: Can you review and control who has administrative access to your phone system?
- Incident response: What procedures are in place if a security breach or service disruption occurs?
- Data handling: Where is your call data stored, and does the supplier comply with UK data protection laws?
- Service Level Agreements (SLAs): Check for clear commitments on uptime, support response times, and security responsibilities.
Simple internal checks to complement supplier verification
- Review user accounts and permissions regularly to ensure only authorised staff can access the system.
- Ensure your own network firewall and router are configured to restrict VoIP traffic to trusted sources.
- Enable MFA on any management portals or admin interfaces you control.
- Check that call recordings or logs containing personal data are stored securely and access is limited.
By following these steps, you can better assess whether your VoIP supplier aligns with NCSC good practice and supports your business's security and compliance needs. If you're unsure how to evaluate these aspects or want to improve your overall telephony security, consider consulting a trusted managed IT provider or IT advisor with experience in UK SME cybersecurity. They can help you ask the right questions, interpret technical details, and implement suitable controls without unnecessary complexity.