Beyond VoIP: Why Secure VTC Needs a Physical Disconnect

Understanding the security requirements behind compliant video teleconferencing.

Video collaboration has become the connective tissue of the modern mission. Real time face to face conversation, content sharing, and remote coordination now happen everywhere from the desktop to the conference room. In most environments that convenience carries little risk. In spaces where sensitive government information is stored, processed or discussed, the same collaboration devices introduce a security problem that is easy to overlook.

As opposed to the cyber risks that are often the focus, the risk that is often ignored is physical. Microphones, cameras, and speakers can transmit audio and video in ways their designers never intended, whether through unintended emissions, a device left active, or a component that continues to pick up sound when a call is supposedly over.

For teams protecting national security information, that possibility is the whole ballgame. A conference room endpoint or a desktop softphone is, at its core, a networked computer with a microphone and a lens pointed into a sensitive discussion area. Securing it is not optional, and it is not a matter of software settings alone.

The framework that governs voice and video security

The safeguards for this problem are set at the national level. The Committee on National Security Systems (CNSS), through its National Telecommunications Security Working Group (NTSWG), maintains the Telecommunications Security Group (TSG) standards that define how voice and video products must behave in sensitive spaces.

The anchor guidance is provided by the CNSSI 5000, which provides guidance for on hook security of telephone systems located in areas where sensitive information is discussed. As collaboration moved from the desk phone to full video teleconferencing (VTC) and software based clients the instruction was extended to add to cover video channels and the specific risks they carry.

The CNSSI Annex J establishes guidance for softphones while Annex K establishes the same for VTC security: it sets the expectation that video teleconferencing appliances in sensitive spaces meet TSG security requirements rather than relying on the built-in controls of commercial collaboration hardware.

What does compliance mean for video?

Meeting these requirements is a matter of hardware assurance and verified functionality, not just policy language. The published technical security guidance makes the practical expectations clear. For desktop and room-based video collaboration in sensitive or classified areas, the recurring themes are consistent:

• Positive Disconnect - Approved TSG devices must be placed between the compute endpoint and the camera and headset peripherals, so that audio and video paths are physically broken when not in active, authorized use rather than merely muted in software. The use of the positive disconnect provides the hard assurance to mitigate the risk of human error when leaving peripherals connected.
• Validated Equipment - Verified devices must appear on the approved TSG product list (the TSG-6 list) published by the NTSWG, giving security teams a defensible way to confirm that what is deployed has actually been evaluated.
• On-hook Security - The core objective is assurance that an audio or video device cannot capture or transmit when it should be inactive, addressing the exact failure mode that makes an ordinary endpoint a liability in a secure area.
• Compliant Desktop Video Peripherals - A webcam peripherals must meet strict guidelines to be considered TSG compliant such as wired only (no radios), a physical lens cover, no extraneous ports (such as an open USB port), no microphone and 360-degree visible indicator that the webcam is in use.
• Emanations Protection - Since unintentional electronic, acoustic, or physical signals can be leaked can by audio and video devices, TEMPEST VTC endpoints with TSG protections are engineered to provide an additional layer of defense in the most challenging environments. Confirm with your FSO where TEMPEST protection is required.

By implementing these controls, CIS Secure transforms a commercial collaboration device into one that a security officer can confidently authorize for a sensitive space, with evidence to back the decision.

Why this matters now

Video collaboration is not slowing down, and neither is federal attention to securing it. Current agency guidance continues to reinforce hardware based VTC protections: recent policy requires disconnect devices between the computer and its camera or headset, insists on the use of approved and listed equipment, and separates the handling of unclassified and classified video environments. For program leaders, facility security officers, and accreditation teams, the message is that video security is a documented, auditable requirement, not a best effort.

The organizations that navigate this well treat compliant video collaboration as a design choice made early, not a remediation exercise imposed late. Selecting endpoints that already carry the right approvals removes friction from accreditation and keeps the mission moving.

How CIS Secure helps

CIS Secure builds TSG certified secure video and voice endpoints and compliant peripherals designed to meet these requirements out of the box, so security and mission teams can deploy modern collaboration tools without compromising on protection. To talk through securing video collaboration in your environment, connect with our team or learn more here: Secure Collaboration - CISSecure.

Sources and further reading

• Committee on National Security Systems, TSG Standards. https://www.cnss.gov/CNSS/issuances/TSG_Standards.cfm Primary source for the TSG standards regime.
• CNSSI No. 5000, Guidelines for VoIP Computer Telephony (public version). https://www.cdse.edu/Portals/124/Documents/jobaids/cyber/cnssi5000.pdf On hook security guidance for sensitive discussion areas.
• U.S. Department of Energy, Technical Surveillance Countermeasures, Chapter 9 (July 2024). https://www.energy.gov/sites/default/files/2024-07/Technical-Surveillance-Countermeasures.pdf Recent federal guidance on desktop VTC requirements, disconnect devices, and the TSG-6 list.
• U.S. Department of State, 5 FAM 590, VTC on Enterprise Networks (updated March 2025). https://fam.state.gov/fam/05fam/05fam0590.html Current federal VTC security policy in practice.