# Unified CM security hardening

Canonical: https://warmtransfer.net/knowledge/cucm-security-hardening

Last verified: 2026-09-25

A Cisco Unified Communications Manager (Unified CM) cluster installs in non-secure mode by default, providing no secure signaling or media services in that state[^39]. Hardening the deployment involves enabling mixed mode, managing trust certificates, configuring cipher and protocol baselines, and applying platform-level access controls[^36][^11][^50].

## Security Modes and Cluster Signaling

Mixed mode enables a Unified CM cluster to serve secure and non-secure endpoints concurrently, employing TLS for signaling and SRTP for media on secure devices[^36]. Transitioning to mixed mode requires the Certificate Authority Proxy Function (CAPF) service and Certificate Trust List (CTL) service to be active on the publisher node before the change[^34]. Operationally, mixed mode requires Unified CM to be registered with Cisco Smart Software Manager or a satellite using a token that has Allow Export-Controlled functionality enabled[^37].

Administrators configure cluster security modes from the CLI of the publisher node using the following commands:
- `utils ctl set-cluster mixed-mode` enables mixed mode[^35].
- `utils ctl set-cluster non-secure-mode` reverts the cluster to non-secure mode[^40].
- `utils ctl update CTLFile` regenerates the CTL file and propagates the update across all cluster nodes[^16].

For SIP trunks, enabling SRTP alongside a non-secure trunk security profile permits SRTP to function, but cryptographic keys are exposed in clear text within signaling and trace logs[^55].

## Certificate Management and Trust Architecture

Unified CM includes the Trust Verification Service (TVS) on cluster servers to validate certificates on behalf of Cisco IP phones, removing the need for phones to hold every trusted certificate locally[^57]. Certain certificates have strict operational rules:
- Unified CM does not support certificates containing wildcard entries, such as `*.example.com`[^38].
- The ITLRecovery certificate is strictly self-signed and cannot be CA-signed[^32].
- When regenerating multiple certificates, the TFTP certificate must be regenerated last[^45].
- A new system backup must be generated every time the TFTP certificate is regenerated[^4].

To monitor certificate validity, the Cisco Certificate Expiry Monitor service performs checks every 24 hours by default, shifting to hourly checks once a certificate expires or enters its final 24 hours of validity[^8].

## Cryptographic Baselines and Standards

Unified CM supports TLS 1.3 beginning in Release 15SU2[^54]. The minimum TLS protocol level is defined using `set tls min-version` (such as `set tls min-version 1.3`) and viewed with `show tls min-version`[^53]. When configured on the publisher, this minimum version setting replicates across the cluster, but IM and Presence nodes require separate configuration, and all cluster nodes must be restarted before the change takes effect[^52].

Within Cipher Management settings, leaving the field empty retains the default ciphers, and Unified CM prevents the use of specific weak ciphers even if they are entered[^11].

For standards compliance, running `utils fips enable` reboots the node, runs certification self-tests during system boot, verifies cryptographic module integrity, and regenerates keying material[^25]. If any FIPS self-test fails, the server halts[^30]. Common Criteria mode (`utils fips_common_criteria enable`) requires FIPS mode to be active beforehand and cannot be used with TLS 1.3[^7]. WarmTransfer's reading of the sources is that because Release 15 designates its implementation as FIPS 140-2, and NIST placed all FIPS 140-2 certificates onto the Historical List on 22 September 2026, a US organisation with a FIPS 140-3 procurement requirement cannot assume Unified CM FIPS mode satisfies it without confirming Cisco's active CMVP status[^28].

## Platform Hardening and Appliance Access

Unified CM operates as a closed, turnkey appliance that restricts native operating system interfaces and permits interaction only via Cisco GUI, CLI, or API surfaces[^12]. The underlying platform enforces security controls:
- SELinux enforcing mode and the IPTables host firewall are active by default, and active firewall rules can be verified using `utils firewall ipv4 list` and `utils firewall ipv6 list`[^49].
- 3 distinct audit logs are collected: the Linux auditd log, the Unified CM application audit log, and the Informix database audit log[^3].
- Cisco warns that database audit logging creates significant volumes of data quickly and can degrade performance under heavy system load[^20].
- Remote audit logging over syslog uses UDP by default in normal mode, with options to switch to TCP or TLS (supporting unidirectional or bidirectional X.509 authentication)[^47].

Role-based access control provides Read, Update, or No Access permissions per resource[^48]. Standard roles and their associated standard access control groups cannot have their privileges or role assignments modified; administrators must create custom roles (either from scratch or copied from an existing role) to enforce least privilege[^50]. When users belong to multiple access control groups, the enterprise parameter Effective Access Privileges For Overlapping User Groups and Roles defaults to Maximum (granting the highest permissions), though it can be adjusted to Minimum[^41].

Credential policies define requirements for end-user PINs, application-user passwords, and end-user passwords, though end-user password controls cease to apply once LDAP authentication is activated[^14]. Furthermore, credential policies never govern operating system or CLI accounts, which rely on OS-level verification rules[^13]. WarmTransfer's reading of the sources is that because credential policies exclude CLI/OS accounts and LDAP-authenticated end-user passwords, lockout thresholds and complexity for these users must be enforced by the external directory for LDAP accounts and by the host OS for CLI logins[^33].

## Vulnerability Remediation

A static root SSH credential vulnerability tracked as CVE-2025-20309 (cisco-sa-cucm-ssh-m4UBdpE7) affects Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1 regardless of device configuration, carrying a CVSS 3.1 base score of 10.0[^19]. No workaround exists; remediation requires upgrading to Release 15SU3 (July 2025) or installing patch COP file `ciscocm.CSCwp27755_D0247-1.cop.sha512`[^17]. The published indicator of compromise is an entry showing a successful root SSH login in `/var/log/active/syslog/secure`[^18].

## See also

See also [SIP TLS handshake failures on trunks](https://warmtransfer.net/knowledge/sip-tls-handshake-failures).
See also [Planning a Unified CM upgrade](https://warmtransfer.net/knowledge/cucm-upgrade-planning).
See also [Certificate lifecycle management for voice](https://warmtransfer.net/knowledge/certificate-lifecycle).

## Applicability

Applies to: Cisco Unified Communications Manager. Deployments: on-premises. Sources checked 2026-09-25. TLS 1.3 configuration specifically requires Release 15SU2 or later[^54]. CVE-2025-20309 applies to Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1[^19]. WarmTransfer's reading of the sources is that FIPS procurement considerations apply to US organizations with a FIPS 140-3 requirement[^28].

## What remains uncertain

Other Unified CM PSIRT advisories published 2025-2026 are not covered by the sources below. SAML SSO and smart card admin authentication for Unified CM are not covered by the sources below. CTI JTAPI and TAPI authentication and encryption setup are not covered by the sources below. Per-model phone support for RSA and TLS versions is not covered by the sources below. SIP OAuth mode chapter details regarding ports, endpoint support, and prerequisites are not covered by the sources below. Numeric default credential policy values, including failed logon threshold, lockout duration, and expiry, are not covered by the sources below. Third-party hardening baselines such as DISA STIG or CIS for Unified CM are not covered by the sources below. The secure recording and monitoring chapter is not covered by the sources below.

## Sources

[^1]: Audit logging is configured in Cisco Unified Serviceability under Tools > Audit Log Configuration. Changing it requires the Audit role, which the CCMAdministrator account holds by default. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010100.html), Audit Logs > Configure Audit Logging. Checked 2026-09-25.
[^2]: Application audit logging is on by default. Database audit logging and system (auditd) audit logging are off by default, and auditd is enabled from the CLI with utils auditd. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010100.html), Audit Logs > Audit Logging (application / database / OS). Checked 2026-09-25.
[^3]: Unified CM has three audit logs: the Linux auditd log, the Unified CM application audit log and the Informix database audit log. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_os-hardening.html), Operating System and Security Hardening > Audit Logging. Checked 2026-09-25.
[^4]: Create a new system backup every time the TFTP certificate is regenerated. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Regenerate Certificates > backup note. Checked 2026-09-25.
[^5]: After regenerating the CallManager certificate, restart the Cisco CallManager, Cisco CTIManager and HAProxy services, and update the CTL file if the cluster is in mixed mode. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Certificate names and descriptions / restart table. Checked 2026-09-25.
[^6]: CAPF certificate operations can authenticate the phone by authentication string, by null string (no user action, low security) or by existing certificate (LSC or MIC precedence). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_phone-security_reorg.html), Phone Security > CAPF authentication mode. Checked 2026-09-25.
[^7]: Common Criteria mode (utils fips_common_criteria enable) needs FIPS mode enabled first and does not work with TLS 1.3. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Common Criteria Mode. Checked 2026-09-25.
[^8]: The Cisco Certificate Expiry Monitor service checks certificates every 24 hours by default. It checks hourly once a certificate has expired or will expire within a day. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Certificate Monitoring. Checked 2026-09-25.
[^9]: In Cipher Management, changing All TLS or the SSH cipher, key exchange or MAC fields requires rebooting all cluster nodes. HTTPS TLS needs a Cisco Tomcat restart and SIP TLS needs a Unified CM restart. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_cipher-management_r_15.html), Cipher Management > Cipher field restrictions / actions table. Checked 2026-09-25.
[^10]: The Cipher Management page warns that configuring hmac-sha2-512 as SSH MAC, or restricting to GCM ciphers or a single key-exchange algorithm, can break DRS and CDR functionality. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_cipher-management_r_15.html), Cipher Management > SSH field cautions. Checked 2026-09-25.
[^11]: An empty Cipher Management field means the default ciphers apply. Certain weak ciphers are never allowed, even if configured. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cipher Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_cipher-management_r_15.html), Cipher Management > overview notes. Checked 2026-09-25.
[^12]: Unified CM is a closed, turnkey appliance. Native OS interfaces are restricted, and access is only through the Cisco-provided GUI, CLI or API. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_os-hardening.html), Operating System and Security Hardening > overview. Checked 2026-09-25.
[^13]: Credential policies do not apply to operating system or CLI users, which follow the operating system's own password verification. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_credential-policies.html), Credential Policies > overview note. Checked 2026-09-25.
[^14]: Credential policies apply to end-user PINs, application-user passwords and end-user passwords. When LDAP authentication is enabled, they no longer apply to end-user passwords. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_credential-policies.html), Credential Policies > overview. Checked 2026-09-25.
[^15]: In mixed mode only, you must update the CTL file after regenerating the CallManager, CAPF or ITLRecovery certificate. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Regenerate Certificates > CTL update note. Checked 2026-09-25.
[^16]: utils ctl update CTLFile regenerates the CTL file and updates it across the cluster nodes. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Update the CTL File. Checked 2026-09-25.
[^17]: No workaround exists for CVE-2025-20309. The fix is Release 15SU3 (July 2025) or the COP patch file ciscocm.CSCwp27755_D0247-1.cop.sha512. Source: [Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7), Advisory > Workarounds; Fixed Software. Checked 2026-09-25.
[^18]: The advisory's indicator of compromise for CVE-2025-20309 is a successful root SSH login recorded in /var/log/active/syslog/secure. Source: [Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7), Advisory > Indicators of Compromise. Checked 2026-09-25.
[^19]: CVE-2025-20309 (cisco-sa-cucm-ssh-m4UBdpE7) is a static root SSH credential in Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. It applies regardless of device configuration and has a CVSS 3.1 base score of 10.0. Source: [Cisco Unified Communications Manager Static SSH Credentials Vulnerability (cisco-sa-cucm-ssh-m4UBdpE7)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssh-m4UBdpE7), Advisory > Summary; Affected Products. Checked 2026-09-25.
[^20]: Cisco warns that database audit logging can generate large amounts of data quickly and can significantly affect performance during heavy use. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010100.html), Audit Logs > Database Audit Logs caution. Checked 2026-09-25.
[^21]: Under Enhanced Security Mode, contact search authentication is enabled by default, and the default remote audit logging transport changes to TCP unless TLS is already configured. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enhanced Security Mode. Checked 2026-09-25.
[^22]: Enhanced Security Mode (utils EnhancedSecurityMode enable) runs on FIPS-enabled systems. It requires passwords of 14 to 127 characters with lowercase, uppercase, digit and special characters, blocks reuse of the last 24 passwords, and sets a 60-day maximum age. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enhanced Security Mode. Checked 2026-09-25.
[^23]: Enabling FIPS mode regenerates certificates and the SSH key automatically, so third-party CA-signed certificates must be uploaded again afterwards. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode. Checked 2026-09-25.
[^24]: The Security Guide advises disabling FIPS mode before upgrading to a version that is not FIPS-compliant. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > cautions. Checked 2026-09-25.
[^25]: utils fips enable reboots the node, runs certification self-tests at startup, checks cryptographic module integrity and regenerates keying material. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode. Checked 2026-09-25.
[^26]: The Release 15 Security Guide describes Unified CM FIPS mode as FIPS 140-2 mode, and its New and Changed Information page does not mention FIPS 140-3. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode (heading). Checked 2026-09-25.
[^27]: FIPS mode requires a security password of at least 14 characters, and every node in the cluster must be in the same mode, all FIPS or all non-FIPS. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode > Before you begin. Checked 2026-09-25.
[^28]: Because the Release 15 guide labels Unified CM FIPS mode as FIPS 140-2 and NIST moved all 140-2 certificates to the Historical List on 22 September 2026, an organisation with a FIPS 140-3 procurement requirement cannot assume Unified CM FIPS mode meets it without checking Cisco's current CMVP certificate status (inferred). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode (heading), combined with NIST timeline. Checked 2026-09-25.
[^29]: In FIPS mode, MD5 and DES do not work. SNMPv3 must use SHA authentication with AES128 privacy, and Certificate Remote Enrolment is not supported. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > FIPS mode restrictions. Checked 2026-09-25.
[^30]: If any FIPS self-test fails, the Unified CM server halts. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > caution. Checked 2026-09-25.
[^31]: In a cluster, enable FIPS on the publisher first and wait for phones to re-register before enabling it on other nodes. Do not run security mode commands on all nodes at once. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - FIPS Mode Setup](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_fips-mode-setup_su2_reorg.html), FIPS Mode Setup > Enable FIPS 140-2 Mode > procedure notes. Checked 2026-09-25.
[^32]: The ITLRecovery certificate is self-signed only and cannot be CA-signed. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Certificate types > ITLRecovery. Checked 2026-09-25.
[^33]: Because Unified CM credential policies do not cover CLI/OS users or LDAP-authenticated end-user passwords, lockout and complexity for those accounts must be enforced elsewhere: at the directory for LDAP users and by the platform OS rules for CLI users (inferred). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Credential Policies](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_credential-policies.html), Credential Policies > overview (derived). Checked 2026-09-25.
[^34]: Before moving a cluster from non-secure mode to mixed mode, the Certificate Authority Proxy Function (CAPF) service and the Certificate Trust List (CTL) service must be enabled on the publisher. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Mixed Mode. Checked 2026-09-25.
[^35]: To enable mixed mode, run utils ctl set-cluster mixed-mode from the CLI on the publisher node. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Configure Mixed Mode through CLI (utils ctl set-cluster mixed-mode). Checked 2026-09-25.
[^36]: Mixed mode lets a Unified CM cluster serve secure and non-secure endpoints together, using TLS for signaling and SRTP for media on secure endpoints. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Mixed Mode. Checked 2026-09-25.
[^37]: Mixed mode requires Unified CM to be registered with Cisco Smart Software Manager or a satellite, using a registration token with Allow Export-Controlled functionality enabled. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Mixed Mode > prerequisites. Checked 2026-09-25.
[^38]: Unified CM does not support certificates with wildcard entries such as *.example.com. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > restrictions (wildcard entry). Checked 2026-09-25.
[^39]: A Unified CM cluster is installed in non-secure mode by default, and in that mode it provides no secure signaling or media services. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > Non-Secure Mode (Default Mode). Checked 2026-09-25.
[^40]: utils ctl set-cluster non-secure-mode returns a mixed-mode cluster to non-secure mode. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_ucm-security-modes_reorg.html), Security Modes > CLI commands for CTL (utils ctl set-cluster non-secure-mode). Checked 2026-09-25.
[^41]: The enterprise parameter Effective Access Privileges For Overlapping User Groups and Roles defaults to Maximum, meaning a user in several access control groups gets the highest privileges among them. It can be set to Minimum. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010.html), Manage User Access > Configure Overlapping Privilege Policy for Access Control Groups. Checked 2026-09-25.
[^42]: The Phone Security chapter lists optional phone hardening settings: Gratuitous ARP disable, Web Access disable, PC Port disable, Settings Access disable and PC Voice VLAN Access disable. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_phone-security_reorg.html), Phone Security > Phone Hardening. Checked 2026-09-25.
[^43]: The Authenticated and Encrypted phone device security modes require the cluster to be in mixed mode. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_phone-security_reorg.html), Phone Security > prerequisites. Checked 2026-09-25.
[^44]: Phone security profiles offer three device security modes: Non Secure (TCP), Authenticated (TLS with NULL/SHA) and Encrypted (TLS with AES signaling, plus SRTP media on encrypted calls). Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_phone-security_reorg.html), Phone Security > Phone Security Profile > Device Security Mode. Checked 2026-09-25.
[^45]: If you regenerate several certificates, regenerate the TFTP certificate last. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificates](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_certificates.html), Certificates > Regenerate Certificates. Checked 2026-09-25.
[^46]: The Audit Logs chapter says the remote syslog server and IPsec between each cluster node and that server must be set up before remote audit logging is configured. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010100.html), Audit Logs > Set Up Remote Audit Logging > Before you begin. Checked 2026-09-25.
[^47]: Remote audit logging to syslog uses UDP by default in normal mode and can be changed to TCP or TLS. TLS supports unidirectional or bidirectional X.509 authentication. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Audit Logs](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010100.html), Audit Logs > Audit Log Configuration Settings > Transport Protocol. Checked 2026-09-25.
[^48]: Unified CM roles grant each resource one of three permission levels: Read, Update or No Access. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010.html), Manage User Access > Roles. Checked 2026-09-25.
[^49]: SELinux enforcing mode and the IPTables host firewall are both enabled by default on Unified CM. Firewall rules can be listed with utils firewall ipv4 list and utils firewall ipv6 list. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Operating System and Security Hardening](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_os-hardening.html), Operating System and Security Hardening > SELinux / IPTables. Checked 2026-09-25.
[^50]: For standard roles and their associated standard access control groups, the privileges and role assignments cannot be edited. Custom roles are needed for least-privilege administration and can be created from scratch or by copying an existing role. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010.html), Manage User Access > Standard Roles and Access Control Groups; Create a Custom Role. Checked 2026-09-25.
[^51]: On a fresh install the minimum TLS version is 1.2, with TLS 1.0 and 1.1 disabled. An upgrade or migration keeps the minimum TLS version from the previous release. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards)](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_tls-setup_2.html), TLS 1.3 Setup > Supported TLS versions (fresh install vs upgrade). Checked 2026-09-25.
[^52]: A minimum TLS version change made on the publisher replicates to the other cluster nodes. IM and Presence must be configured separately, and all nodes must be restarted for the change to take effect. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards)](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_tls-setup_2.html), TLS 1.3 Setup > Set Minimum TLS Version > notes. Checked 2026-09-25.
[^53]: The minimum TLS version is set with set tls min-version (for example, set tls min-version 1.3) and checked with show tls min-version. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards)](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_tls-setup_2.html), TLS 1.3 Setup > Set Minimum TLS Version. Checked 2026-09-25.
[^54]: Unified CM supports TLS 1.3 from Release 15SU2 onwards. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - TLS 1.3 Setup (From Release 15SU2 Onwards)](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_tls-setup_2.html), TLS 1.3 Setup (From Release 15SU2 Onwards) > chapter title and overview. Checked 2026-09-25.
[^55]: If SRTP is allowed on a SIP trunk that uses a non-secure trunk security profile, SRTP still works but the keys are exposed in signaling and traces. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SRTP Allowed warning. Checked 2026-09-25.
[^56]: A SIP trunk security profile using TLS authenticates the peer against its Secure Certificate Subject or Subject Alternate Name field. The default TLS port is 5061. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_trunk-and-gateway-sip-security_reog.html), Trunk and Gateway SIP Security > SIP Trunk Security Profile settings. Checked 2026-09-25.
[^57]: The Trust Verification Service (TVS) runs on Unified CM servers and authenticates certificates on behalf of Cisco IP phones, so phones do not need to store every trusted certificate locally. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_default-security-setup_su2_reorg.html), Default Security > Trust Verification Service. Checked 2026-09-25.
[^58]: Access control groups carry a user rank from 1 to 10, with 1 the highest and the default. A user can only be added to groups whose minimum rank the user meets. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage User Access](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010.html), Manage User Access > User Rank Hierarchy. Checked 2026-09-25.