If it has a direct connection to the Internet, ensure that the firewal feature set is properly configured.

If using a SIP trunk service and you need to open port 5060, ensure that you configure the system to only accept calls from specific IP addresses and networks, typically only your inside voice networks and ITSP servers.

Configure your AA to disallow callers from making external calls via the AA.

Use SSH vice telnet if accessing direct from the Internet and limit to specific IP addresses that are allowed to connect.

Implement the advanced login protections if accessible via the Internet to reduce the attack surface.

Configure NTP servers and enable logging.

Use strong passwords.