Skip to content

Vishing

What is Vishing?

Voice phishing, a social engineering attack that uses phone calls or voice messages to trick victims into revealing sensitive information. Vishing attacks often impersonate banks, government agencies, or technical support.

Information Security

Frameworks that govern vishing

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on vishing

Requirements naming vishing across 3 standards, quoted from the control text.

Lloyd's Minimum Standards - Cyber Security1 control

Attacks are detected. Foundational: attacks are detected at the endpoints and at the perimeter, backed by scanning of stored files, with false positives reduced through alert tuning.

lloyd-s-minimum-standards-cyber-security::P12.3.5 · 12.3.5 Cyber detection →
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)1 control

Apply Section 5 target vulnerability validation including: password cracking (offline against captured hashes per RoE + John the Ripper + Hashcat + dictionary attacks + rainbow tables) + penetration testing (Sections 5.2 + 5.3 covering planning + discovery + a...

NISTSP115-4 · Target Vulnerability Validation - Password Cracking, Pen Testing, Social Engineering →
RBI Cybersecurity Framework for Banks1 control

The CCMP addresses detection, containment, response and recovery; the bank takes measures to prevent attacks and detect intrusions promptly, prepares for zero-day, remote access and targeted attacks, and addresses threats including denial of service and DDoS,...

rbi-cybersecurity-framework-for-banks::193 · Para 193: CCMP covers detection, containment, response and recovery for a wide threat set →

Questions people ask about vishing

What is Vishing?
Voice phishing, a social engineering attack that uses phone calls or voice messages to trick victims into revealing sensitive information. Vishing attacks often impersonate banks, government agencies, or technical support.
Why is Vishing important for compliance?
Vishing is a key concept in Information Security. Understanding vishing helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Vishing?
Vishing appears in the requirement text of Lloyd's Minimum Standards - Cyber Security, NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), RBI Cybersecurity Framework for Banks. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Vishing?
Explore our compliance framework pages to see how vishing applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Vishing applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.