S 2.470 Procedure for carrying out a requirements analysis for PBX systems

Initiation responsibility: Head of IT

Implementation responsibility: IT Security Officer, Administrator

Before purchasing a PBX system or expanding an existing system, it makes sense to carry out a requirements analysis. In the framework of this, the basic question should be clarified first as to which functions the PBX system should offer in addition to telephony. Furthermore, the operational scenario of the PBX system should be clarified. A PBX system may be installed, for example, solely for customer contact, for office-internal communication or for use in a call centre. Operational scenarios can clarify which communication services are required. In addition, the number of end devices and the number of connections that can be used simultaneously is relevant when selecting a PBX system. The result should make it possible to plan and thus select a secure PBX system which is suitable for the organisation.

The results of the requirements analysis must be documented and co-ordinated with the corresponding persons responsible for IT.

The following questions must be clarified in the framework of the requirements analysis, among others:

• In which form is the PBX system to be used: as a classic PBX system, as a VoIP system or as a hybrid system? Or is an IP system connection a possible alternative?
• How many internal and external connections should the PBX system be able to administrate? Is it possible to increase this number after the system has been purchased?
  How will connection to the public telephone network be made? Is the number of simultaneous calls defined (ISDN or S2m lines) or should it be variable (IP system connection)?
• How many simultaneous internal communication connections should be possible?
• What are the tasks the planned PBX system is to fulfil? What are the functions to be provided? Are there functions which absolutely must be provided?
• Can all required functions be provided at the workplace by existing end devices in connection with the PBX system or is it necessary to purchase new end devices?
• Does the existing cabling fulfil the requirements of a PBX system or is it necessary to replace the cabling?
• Is a new PBX system to be purchased or is it possible to expand an existing PBX system?
• Are there special demands on the availability of the PBX system or the confidentiality or integrity of the stored or processed data?
• Does the PBX system offer the ability to subsequently implement additional functions (hardware, software and/or firmware)?
• Is a communication between several PBX systems planned in order to connect different sites or branch offices of the organisation? Are these existing PBX systems compatible with the new system to be planned so that all required functions are available throughout the entire organisation?
• How is the security of the PBX system (site and data access), of the telephone network, and the end devices ensured?
• Is a service or maintenance contract required for the PBX system? Are prompt repair and fault management possible?

Based on the results, the requirements for the PBX system should be defined and specified. Additional market analysis and advice by external specialist companies help to elaborate a concrete plan and purchase a PBX system suitable for the organisation based on the requirements. More detailed information can be found in safeguards S 2.471 Planning the use of PBX systems and S 2.105 Obtaining PBX units.

Review questions:

• Have the requirements been taken into account when the PBX system was deployed?
• Have the requirements of the PBX system been co-ordinated with the persons responsible for IT?