Introduction

The past decade has seen an explosion of government regulation that will directly or indirectly affect VoIP implementation security. Some of these regulations can be addressed by selecting and implementing compliant equipment, but the vast majority of these are operational in nature, meaning that to ensure compliance you ll need to pay more attention to (1) how your IP communications systems are designed and (2) how your organization s business and IT operations groups are using the equipment once it s live.

For this chapter, each applicable set of regulations will be discussed separately. What you ll want to ask yourself in each section is:

• Does this regulation apply to me and my organization (or my client s organization)?

• Who in my organization has responsibility for overall compliance with this regulation? In some cases, the answer may be you if there isn t already someone designated, but for many of these regulations your organization is likely to have a person or group specifically designated as the lead for addressing compliance, particularly with regulations for which security is only an ancillary component of the overall regulation.

• Is it likely that my systems and/or operations are not compliant with this regulation today? If you suspect that remediation is necessary, it s important to raise the concern to the appropriate level of management in a way that allows the issue to be corrected and reduce the risk of fines, negative publicity, or worse.

  Warning

  Always consult experienced legal counsel (or your organization s audit or compliance department) for...