The practices we'd put in place control who can get in and what they can reach. Require strong sign-in for administrators, limit who can join meetings from outside, restrict who can open stored recordings, and close accounts when people leave. Encryption in transit protects a conversation while it crosses the network. It doesn't decide who is allowed to sign in or who can play a recording back afterward, so those decisions need settings of their own.
\n","summary":"UCaaS security practice that reduces breach risk controls who can get in and what they can reach: strong sign-in for administrators, limits on outside meeting access, restricted access to stored recordings and closed accounts when people leave. Encryption in transit doesn't settle account access.","publishedAt":"2026-06-29T14:28:52.784","verifiedAt":"2026-09-14T00:00:00","editorialStatus":"APPROVED","lastReviewedAt":"2026-10-10T04:30:28.188","nextReviewDueAt":"2026-12-14T00:00:00","templateVersion":"v2","aliases":["How do you secure a UCaaS platform against data breaches?","UCaaS security checklist","How do I prevent a data breach on a cloud phone system?","What security controls should a UCaaS provider have?","Is UCaaS secure?","How do you protect call recordings and voicemail in a cloud phone system?","What should I ask a UCaaS vendor about security?"],"confidenceScore":76,"confidenceLabel":"Medium","canonicalUrl":"https://safe.security/resources/insights/data-breach-prevention-best-practices"},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"contributorOrganizationProfile":null,"contributorPerson":null,"sections":[{"id":"1ff60ec6-9157-4b12-90a0-c169e0cba245","sectionKey":"what_encryption_in_transit_covers","sectionType":"markdown_section","heading":"What encryption in transit covers","introMarkdown":"In Microsoft Teams, network communications are [encrypted by default](https://learn.microsoft.com/en-us/microsoftteams/teams-security-guide). TLS protects the signaling and SRTP protects the audio and video. That covers a call while it crosses the network. Other services publish their own descriptions, so read the one for the product you use.\n\nTransport encryption has a narrow job. It stops someone on the network path from reading the traffic. It isn't the same thing as end-to-end encryption, and it doesn't describe what happens to a call once it leaves for the public phone network. We cover that boundary in [whether PSTN calls can be encrypted](https://www.answerstack.io/q/is-pstn-secure-and-can-pstn-calls-be-encrypted).\n\nSomeone who signs in with a stolen password doesn't have to break any of that encryption. They reach what the account can reach, through the normal interface.","introHtml":"In Microsoft Teams, network communications are encrypted by default. TLS protects the signaling and SRTP protects the audio and video. That covers a call while it crosses the network. Other services publish their own descriptions, so read the one for the product you use.
\nTransport encryption has a narrow job. It stops someone on the network path from reading the traffic. It isn't the same thing as end-to-end encryption, and it doesn't describe what happens to a call once it leaves for the public phone network. We cover that boundary in whether PSTN calls can be encrypted.
\nSomeone who signs in with a stolen password doesn't have to break any of that encryption. They reach what the account can reach, through the normal interface.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":10},{"id":"82352fe5-fcf2-464b-9cae-b33265d0b4bd","sectionKey":"how_the_work_divides_in_microsoft_teams","sectionType":"table_section","heading":"How the work divides in Microsoft Teams","introMarkdown":null,"introHtml":null,"outroMarkdown":null,"outroHtml":null,"contentJson":{"rows":[{"cells":["Calls and messages in transit","Encrypted by default with TLS and SRTP","Network and firewall access for the apps"]},{"cells":["Sign-in","Authentication through Entra ID, with Conditional Access on an Entra ID P1 license","Which sign-in methods are required, and for whom"]},{"cells":["Meetings","Anonymous, external and guest access, with lobby and role settings","Which types can join, and who waits in the lobby"]},{"cells":["Recordings","Storage in OneDrive or SharePoint, with permissions that follow the location","Who each file is shared with, and retention labels"]}],"columns":["Area","What Microsoft documents","What your organization sets"]},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":20},{"id":"eb979d0a-8bcd-43c0-894c-79153f348c83","sectionKey":"strong_sign_in_starting_with_administrators","sectionType":"markdown_section","heading":"Strong sign-in, starting with administrators","introMarkdown":"We'd start with administrator accounts, because an administrator can change settings that affect many accounts at once. We'd then extend the requirement to every user account, since a stolen password reaches whatever that account can reach.\n\nTeams shows what a stronger requirement looks like. Its sign-in runs through Microsoft Entra ID, and Entra has a control called an [authentication strength](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths). It lets an administrator say which sign-in methods are accepted for a given resource. The built-in phishing-resistant strength accepts a FIDO2 security key, Windows Hello for Business or a platform credential, and multifactor certificate-based authentication. A password followed by a text message or a push notification satisfies ordinary multifactor authentication. It doesn't satisfy that strength.\n\nThe difference is in how the methods work. A texted code can be typed into a fake sign-in page and passed along to the real one. Microsoft describes the phishing-resistant methods as requiring an interaction between the authentication method and the sign-in surface, so there's no code for the user to hand over.\n\nTwo conditions come with this control. Authentication strengths are part of Conditional Access, which requires a Microsoft Entra ID P1 license. And the policy is evaluated after the initial authentication, so it sets a requirement for reaching the resource and doesn't change the first password prompt. It's a rule about how someone must sign in to get to the admin tools.\n\nOther UCaaS services have their own sign-in systems, and the options depend on the product and the plan. The thing to find out is whether the admin portal can require a second factor, and which factors it accepts.","introHtml":"We'd start with administrator accounts, because an administrator can change settings that affect many accounts at once. We'd then extend the requirement to every user account, since a stolen password reaches whatever that account can reach.
\nTeams shows what a stronger requirement looks like. Its sign-in runs through Microsoft Entra ID, and Entra has a control called an authentication strength. It lets an administrator say which sign-in methods are accepted for a given resource. The built-in phishing-resistant strength accepts a FIDO2 security key, Windows Hello for Business or a platform credential, and multifactor certificate-based authentication. A password followed by a text message or a push notification satisfies ordinary multifactor authentication. It doesn't satisfy that strength.
\nThe difference is in how the methods work. A texted code can be typed into a fake sign-in page and passed along to the real one. Microsoft describes the phishing-resistant methods as requiring an interaction between the authentication method and the sign-in surface, so there's no code for the user to hand over.
\nTwo conditions come with this control. Authentication strengths are part of Conditional Access, which requires a Microsoft Entra ID P1 license. And the policy is evaluated after the initial authentication, so it sets a requirement for reaching the resource and doesn't change the first password prompt. It's a rule about how someone must sign in to get to the admin tools.
\nOther UCaaS services have their own sign-in systems, and the options depend on the product and the plan. The thing to find out is whether the admin portal can require a second factor, and which factors it accepts.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":30},{"id":"d04ddbc8-ed59-4cfb-b126-8a33118b863e","sectionKey":"decide_who_can_join_from_outside","sectionType":"markdown_section","heading":"Decide who can join from outside","introMarkdown":"Meetings bring in people who aren't in your directory, and Teams treats them as different kinds of participant. Anonymous users join from a link without signing in to your organization. External access covers authenticated users from organizations you've chosen to trust. Guest access gives an outside person an account in your tenant, with access to teams, channel documents and chats.\n\nThese reach different things. Anonymous access is a way into a meeting, and guest access extends to a team's channels and files. So the two deserve separate decisions.\n\nIn Teams, an administrator and an organizer make these choices before a meeting starts. They decide which participant types are allowed at all, who joins directly, and who waits in the lobby. For a meeting where client details will be discussed, sending outside participants to the lobby means an organizer, co-organizer or presenter sees each name before admitting it. If you're setting this up for staff at home, [how to set up UCaaS for a remote team](https://www.answerstack.io/q/how-do-you-set-up-ucaas-for-a-remote-team) covers the rest of the rollout.","introHtml":"Meetings bring in people who aren't in your directory, and Teams treats them as different kinds of participant. Anonymous users join from a link without signing in to your organization. External access covers authenticated users from organizations you've chosen to trust. Guest access gives an outside person an account in your tenant, with access to teams, channel documents and chats.
\nThese reach different things. Anonymous access is a way into a meeting, and guest access extends to a team's channels and files. So the two deserve separate decisions.
\nIn Teams, an administrator and an organizer make these choices before a meeting starts. They decide which participant types are allowed at all, who joins directly, and who waits in the lobby. For a meeting where client details will be discussed, sending outside participants to the lobby means an organizer, co-organizer or presenter sees each name before admitting it. If you're setting this up for staff at home, how to set up UCaaS for a remote team covers the rest of the rollout.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":40},{"id":"69a5f8db-c6db-4b21-a91f-993f6290eb7b","sectionKey":"stored_recordings_need_their_own_review","sectionType":"markdown_section","heading":"Stored recordings need their own review","introMarkdown":"A recording outlasts the meeting, and the rules for who can open it are separate from the rules for who could join. In Teams, Microsoft's page on [recording storage and permissions](https://learn.microsoft.com/en-us/microsoftteams/tmr-meeting-recording-change) says a meeting recording is saved to the organizer's OneDrive. A recording of a one-to-one or group call goes to the OneDrive of the person who selected Record. A channel meeting's recording goes to that channel's SharePoint folder. There are fallback locations as well, for example when the organizer has no OneDrive account.\n\nPermissions follow the location. For a regular meeting, invitees inside the organization get a link automatically, and the organizer has to add external participants. For a channel meeting, access is inherited from the channel's owners and members. So a sensitive conversation recorded in a busy channel can be opened by the whole channel, including people who weren't in the meeting.\n\nA dedicated recording service raises the same questions. Suppose a 40-person accounting firm has set up [Atlantech Online's call recording service](https://www.atlantech.net/call-recording) to record its client calls automatically. The service works with Microsoft Teams and cloud business phone systems. Atlantech's page lists role-based permissions, an audit trail, retention rules and legal holds, with storage in the cloud, on premises or split between them.\n\nThe firm has to decide which roles can search and play back calls, and how long a recording is kept before it's deleted. A shorter retention period leaves fewer files to expose if an account is taken over, so we'd set it as short as the firm's record-keeping duties allow. The audit trail gives the firm a record to check after something goes wrong.\n\nA medical practice recording patient calls has further obligations before it turns recording on. We cover those in [UCaaS compliance requirements for healthcare organizations](https://www.answerstack.io/q/what-ucaas-compliance-requirements-apply-to-healthcare-organizations).","introHtml":"A recording outlasts the meeting, and the rules for who can open it are separate from the rules for who could join. In Teams, Microsoft's page on recording storage and permissions says a meeting recording is saved to the organizer's OneDrive. A recording of a one-to-one or group call goes to the OneDrive of the person who selected Record. A channel meeting's recording goes to that channel's SharePoint folder. There are fallback locations as well, for example when the organizer has no OneDrive account.
\nPermissions follow the location. For a regular meeting, invitees inside the organization get a link automatically, and the organizer has to add external participants. For a channel meeting, access is inherited from the channel's owners and members. So a sensitive conversation recorded in a busy channel can be opened by the whole channel, including people who weren't in the meeting.
\nA dedicated recording service raises the same questions. Suppose a 40-person accounting firm has set up Atlantech Online's call recording service to record its client calls automatically. The service works with Microsoft Teams and cloud business phone systems. Atlantech's page lists role-based permissions, an audit trail, retention rules and legal holds, with storage in the cloud, on premises or split between them.
\nThe firm has to decide which roles can search and play back calls, and how long a recording is kept before it's deleted. A shorter retention period leaves fewer files to expose if an account is taken over, so we'd set it as short as the firm's record-keeping duties allow. The audit trail gives the firm a record to check after something goes wrong.
\nA medical practice recording patient calls has further obligations before it turns recording on. We cover those in UCaaS compliance requirements for healthcare organizations.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":50},{"id":"e173ecbf-fabf-4cbb-a352-25ad2b03b1a6","sectionKey":"close_accounts_and_limit_what_a_stolen_one_can_do","sectionType":"markdown_section","heading":"Close accounts and limit what a stolen one can do","introMarkdown":"People leave, and their accounts still hold voicemail, call history, chat and recordings. Disabling a departing employee's account on their last day is ordinary housekeeping. It's a security practice too. The former employee is no longer watching that account, so assign someone responsibility for disabling it and handling its files.\n\nWhere the phone system has its own login, separate from the company directory, give it its own line on the offboarding list. Reassign the person's number and deal with the recordings they own. In Teams, a recording saved to a user's OneDrive is handled like any other file there when the person leaves, so decide who takes those files over as part of the same step. Channel recordings stay in the channel's SharePoint folder. Ask how the service handles sessions that are already signed in when an account is disabled, so you know whether disabling it is enough.\n\nSome settings limit what a stolen account can do. Permissions do that for data: an account whose role doesn't include playback can't open those recordings through that role. Toll fraud is a second case, and it's a loss on the bill, not exposed data. Someone gains access to an extension and runs up international calls. [Atlantech's business phone service](https://www.atlantech.net/solutions/voice/phone) leaves international calling disabled by default for that reason, and turns it on when a customer asks. If your staff never call abroad, leaving it off limits that exposure.","introHtml":"People leave, and their accounts still hold voicemail, call history, chat and recordings. Disabling a departing employee's account on their last day is ordinary housekeeping. It's a security practice too. The former employee is no longer watching that account, so assign someone responsibility for disabling it and handling its files.
\nWhere the phone system has its own login, separate from the company directory, give it its own line on the offboarding list. Reassign the person's number and deal with the recordings they own. In Teams, a recording saved to a user's OneDrive is handled like any other file there when the person leaves, so decide who takes those files over as part of the same step. Channel recordings stay in the channel's SharePoint folder. Ask how the service handles sessions that are already signed in when an account is disabled, so you know whether disabling it is enough.
\nSome settings limit what a stolen account can do. Permissions do that for data: an account whose role doesn't include playback can't open those recordings through that role. Toll fraud is a second case, and it's a loss on the bill, not exposed data. Someone gains access to an extension and runs up international calls. Atlantech's business phone service leaves international calling disabled by default for that reason, and turns it on when a customer asks. If your staff never call abroad, leaving it off limits that exposure.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":60}],"citations":[{"title":"RFC 3711: The Secure Real-time Transport Protocol (SRTP)","url":"https://datatracker.ietf.org/doc/html/rfc3711","excerpt":"SRTP ... can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP).","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"SRTP provides confidentiality, message authentication and replay protection to RTP and RTCP traffic; the encrypted portion is the RTP payload while the authenticated portion is the header plus the encrypted payload; the RTP header itself is not encrypted; key management is outside the scope of SRTP.","domain":"datatracker.ietf.org","publisherName":"Internet Engineering Task Force (IETF)"},{"title":"RFC 3261: SIP: Session Initiation Protocol","url":"https://datatracker.ietf.org/doc/html/rfc3261","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Transport-layer security such as TLS protects SIP signaling between adjacent entities and is distinguished from end-to-end security; proxies must read request URIs and routing headers, so hop-by-hop transport security does not prevent intermediaries from seeing signaling.","domain":"datatracker.ietf.org","publisherName":"IETF"},{"title":"RFC 5630: The Use of the SIPS URI Scheme in SIP","url":"https://datatracker.ietf.org/doc/html/rfc5630","excerpt":"there is nothing that prevents proxies from cheating","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"SIPS requires TLS on each hop rather than end to end, a receiving UAS cannot know for certain that TLS was used on every hop, and nothing prevents proxies from cheating.","domain":"datatracker.ietf.org","publisherName":"IETF"},{"title":"NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management","url":"https://pages.nist.gov/800-63-4/sp800-63b.html","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"AAL2 requires proof of possession and control of two distinct authentication factors; AAL3 requires a hardware-based authenticator with a non-exportable private key providing phishing resistance; manually entered authenticator outputs such as SMS and OTP cannot be phishing resistant; out-of-band aut","domain":"pages.nist.gov","publisherName":"NIST"},{"title":"Implementing Phishing-Resistant MFA (fact sheet, October 2022)","url":"https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf","excerpt":"This form of MFA should only be used as a last resort MFA option.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"FIDO/WebAuthn and PKI-based authentication are the phishing-resistant forms; app-based OTP and number-matched push remain vulnerable to phishing; SMS or voice is vulnerable to phishing, SS7 exploitation and SIM swap and should be a last resort; CISA urges system administrators and other high-value t","domain":"cisa.gov","publisherName":"CISA"},{"title":"NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations","url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","excerpt":"Employ the principle of least privilege, allowing only authorized accesses for users ... that are necessary to accomplish assigned organizational tasks.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Control text used here was read from NIST's OSCAL catalog for this publication: AC-6 least privilege; AC-2 account management including alignment with personnel termination and transfer processes; AC-2(3) disable accounts no longer associated with a user; AU-6 audit record review, analysis and repor","domain":"csrc.nist.gov","publisherName":"NIST"},{"title":"47 CFR 64.2011: Notification of customer proprietary network information security breaches","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-47?section=64.2011","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Carrier must notify the U.S. Secret Service and the FBI no later than seven business days after reasonable determination of a breach; carrier may not notify customers or the public until seven full business days after that notification, with an immediate-harm exception after consultation with the in","domain":"ecfr.gov","publisherName":"eCFR (U.S. Government Publishing Office)"},{"title":"47 CFR 64.2003: Definitions (CPNI subpart)","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-47?section=64.2003","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"For this subpart, telecommunications carrier includes an entity that provides interconnected VoIP service, which is what brings cloud calling providers inside the CPNI rules.","domain":"ecfr.gov","publisherName":"eCFR (U.S. Government Publishing Office)"},{"title":"45 CFR 164.404: Notification to individuals (HIPAA Breach Notification Rule)","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-45?section=164.404","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery, written in plain language, describing what happened and what individuals should do.","domain":"ecfr.gov","publisherName":"eCFR (U.S. Government Publishing Office)"},{"title":null,"url":"https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business","excerpt":"don't turn any machines off until the forensics experts arrive","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Secure operations and fix vulnerabilities quickly; do not destroy forensic evidence and do not turn machines off before forensics experts arrive; assemble a response team spanning forensics, legal, IT, operations, HR and communications; check what personal information service providers can access; n","domain":"ftc.gov","publisherName":"FTC"},{"title":"Consumer Alert: Telecommunications Toll Fraud (Public Notice DA 92-728, June 9, 1992)","url":"https://docs.fcc.gov/public/attachments/DA-92-728A1.txt","excerpt":null,"quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"PBX remote access fraud in which unauthorized callers test random authorization codes until one works and calls are billed to the PBX owner; voicemail systems that provide a dial tone or a link to remote access; FCC guidance to disable any part of the system not in regular use and to ask carriers ab","domain":"docs.fcc.gov","publisherName":"U.S. Federal Communications Commission"},{"title":"Microsoft - Teams security guide","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-security-guide","excerpt":"Teams data is encrypted in transit and at rest in Microsoft services, between services, and between clients and services.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Teams encrypts network communications by default using TLS, MTLS and SRTP; SRTP session keys are exchanged over the signaling TLS channel; Teams data is encrypted in transit and at rest, with enterprise data decryptable by the organization for eDiscovery; tenant admins can remove an external phishin","domain":"learn.microsoft.com","publisherName":"Microsoft"},{"title":"Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-end-to-end-encryption","excerpt":"Because the service can't decrypt media, some features that depend on service-side access aren't available.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"E2EE covers meetings and one-to-one calls; meeting organizers need Teams Premium; E2EE is disabled by default for one-to-one calls in the global policy; recording, compliance recording, live captions and transcription, call transfer, park, merge, adding a participant and PSTN dial-in become unavaila","domain":"learn.microsoft.com","publisherName":"Microsoft Learn"},{"title":"Using end-to-end encryption (E2EE) in Zoom meetings","url":"https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0065408","excerpt":null,"quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Zoom meetings and webinars use 256-bit AES-GCM for real-time audio, video and shared content in transit, with keys normally generated and managed by Zoom's servers; with E2EE enabled nobody except the participants, including Zoom's servers, has the keys; enabling E2EE disables cloud recording, live ","domain":"support.zoom.com","publisherName":"Zoom"},{"title":"Enabling end-to-end (E2EE) encryption for Zoom Phone","url":"https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0059027","excerpt":null,"quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Zoom Phone E2EE applies to one-to-one calls between Zoom desktop or mobile apps on the same account, excludes Zoom Rooms, web client and PSTN calls, and disables automatic and ad hoc recording, call monitoring, merge and transfer, call park, DTMF tones and hold music.","domain":"support.zoom.com","publisherName":"Zoom"},{"title":"Security Features, RingCentral Trust Center","url":"https://www.ringcentral.com/trust-center/secure-features.html","excerpt":"Encryption with AES-256 for protection of data at rest helps ensure that your data cannot be read or recovered by unauthorized individuals.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"RingCentral documents TLS and SRTP for data in transit, MLS-based end-to-end encryption for meetings, AES-256 encryption of data at rest, SAML, OAuth and password-based access control, role and permission control short of full administrator access, and a RingCentral Audit Trail for privileged user a","domain":"ringcentral.com","publisherName":"RingCentral"},{"title":"Webex Calling Security White Paper","url":"https://www.cisco.com/c/en/us/products/collateral/conferencing/webex-control-hub/white-paper-c11-743446.html","excerpt":"Media streams between SIP endpoints and the service are secured using the Secure Real-Time Transport Protocol (SRTP), as described in RFC 3711.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Cisco documents SIP call control signaling encrypted with TLS and strong cipher suites, media secured with SRTP as described in RFC 3711, data at rest encrypted using AES 256 including backups and archives, restriction of privileged user IDs to the least privileges necessary, two-factor authenticati","domain":"cisco.com","publisherName":"Cisco"}],"revisions":[{"revisedAt":"2026-06-15T14:28:52.784+00:00","versionLabel":"Originally published","note":"","reviewedBy":null}],"relatedAnswers":[{"id":"f7b5d5d8-aadd-4135-b31d-5ff0dbbf934e","slug":"what-ucaas-deployment-model-suits-enterprises-with-hybrid-infrastructure","question":"What UCaaS deployment model suits enterprises with hybrid infrastructure?","publishedAt":"2026-09-27T14:29:18.879","confidenceScore":null,"confidenceLabel":null,"industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"ucaas","label":"UCaaS","description":null,"schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"For an enterprise with hybrid infrastructure, we'd recommend cloud call control, with equipment kept on site only where a named system, contract or outage requirement needs it. Coexistence, media routing and survivability are separate choices, shown with Teams Direct Routing and, as a separate service, Atlantech's hosted lines.","url":"/q/what-ucaas-deployment-model-suits-enterprises-with-hybrid-infrastructure"},{"id":"790feafe-8a6a-45e3-a954-23056b271d9a","slug":"how-does-ucaas-compare-to-on-premises-pbx","question":"How does UCaaS compare to on-premises PBX?","publishedAt":"2026-09-07T19:54:51.173","confidenceScore":null,"confidenceLabel":null,"industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"ucaas","label":"UCaaS","description":null,"schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"UCaaS and an on-premises PBX do the same calling job in different places. A PBX is equipment at your site that your team or a contractor maintains. UCaaS runs in the provider's cloud for a per-user monthly fee and adds video, chat and mobile apps. Cost, upkeep, outage exposure and control of data all follow from that difference, and a business can keep its PBX while changing the service that feeds it.","url":"/q/how-does-ucaas-compare-to-on-premises-pbx"},{"id":"62173c10-e3cc-4a28-bec3-67d899f7f24f","slug":"how-do-you-evaluate-ucaas-providers-before-buying","question":"How do you evaluate UCaaS providers before buying?","publishedAt":"2026-09-03T14:28:51.344","confidenceScore":86,"confidenceLabel":"High","industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"ucaas","label":"UCaaS","description":null,"schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Evaluate a UCaaS provider in three passes: rule out providers that fail a fixed requirement, compare the rest on written price, term and service terms, then test your own call flow on your own equipment before signing.","url":"/q/how-do-you-evaluate-ucaas-providers-before-buying"},{"id":"a94ef24e-8f5b-40e8-9b5d-ec273215a8c8","slug":"what-ucaas-compliance-requirements-apply-to-healthcare-organizations","question":"What UCaaS compliance requirements apply to healthcare organizations?","publishedAt":"2026-08-25T14:28:52.466","confidenceScore":null,"confidenceLabel":null,"industry":{"id":"ff619d7c-d7d7-485e-a05a-53fba07f33ed","slug":"telecommunications","label":"Telecommunications","description":"Business voice, fiber, UCaaS, and network services"},"topic":{"slug":"ucaas","label":"UCaaS","description":null,"schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"In the United States, HIPAA sets the main requirements. A covered entity using UCaaS has to include it in its Security Rule risk analysis and safeguards, and needs a business associate agreement before using features that store patient information, such as voicemail, recordings and transcripts. HHS's Office for Civil Rights doesn't endorse or certify products.","url":"/q/what-ucaas-compliance-requirements-apply-to-healthcare-organizations"}],"contributorStats":{"verifiedAnswers":149,"openDisputes":0},"schemaJson":{"@context":"https://schema.org","@type":"Question","name":"What UCaaS security best practices reduce data breach risk?","text":"What UCaaS security best practices reduce data breach risk?","url":"https://www.answerstack.io/q/what-ucaas-security-best-practices-reduce-data-breach-risk","answerCount":1,"datePublished":"2026-06-29T14:28:52.784","about":[{"@type":"Thing","name":"UCaaS"},{"@type":"Thing","name":"Telecommunications"}],"acceptedAnswer":{"@type":"Answer","text":"The practices we'd put in place control who can get in and what they can reach. Require strong sign-in for administrators, limit who can join meetings from outside, restrict who can open stored recordings, and close accounts when people leave. Encryption in transit protects a conversation while it crosses the network. It doesn't decide who is allowed to sign in or who can play a recording back afterward, so those decisions need settings of their own.","url":"https://www.answerstack.io/q/what-ucaas-security-best-practices-reduce-data-breach-risk","upvoteCount":0,"datePublished":"2026-06-29T14:28:52.784","dateModified":"2026-09-14T00:00:00","citation":[{"@type":"CreativeWork","name":"RFC 3711: The Secure Real-time Transport Protocol (SRTP)","url":"https://datatracker.ietf.org/doc/html/rfc3711"},{"@type":"CreativeWork","name":"RFC 3261: SIP: Session Initiation Protocol","url":"https://datatracker.ietf.org/doc/html/rfc3261"},{"@type":"CreativeWork","name":"RFC 5630: The Use of the SIPS URI Scheme in SIP","url":"https://datatracker.ietf.org/doc/html/rfc5630"},{"@type":"CreativeWork","name":"NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"@type":"CreativeWork","name":"Implementing Phishing-Resistant MFA (fact sheet, October 2022)","url":"https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf"},{"@type":"CreativeWork","name":"NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations","url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"},{"@type":"CreativeWork","name":"47 CFR 64.2011: Notification of customer proprietary network information security breaches","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-47?section=64.2011"},{"@type":"CreativeWork","name":"47 CFR 64.2003: Definitions (CPNI subpart)","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-47?section=64.2003"},{"@type":"CreativeWork","name":"45 CFR 164.404: Notification to individuals (HIPAA Breach Notification Rule)","url":"https://www.ecfr.gov/api/renderer/v1/content/enhanced/current/title-45?section=164.404"},{"@type":"CreativeWork","name":"https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business","url":"https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business"},{"@type":"CreativeWork","name":"Consumer Alert: Telecommunications Toll Fraud (Public Notice DA 92-728, June 9, 1992)","url":"https://docs.fcc.gov/public/attachments/DA-92-728A1.txt"},{"@type":"CreativeWork","name":"Microsoft - Teams security guide","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-security-guide"},{"@type":"CreativeWork","name":"Manage end-to-end encryption for Microsoft Teams meetings and one-to-one calls","url":"https://learn.microsoft.com/en-us/microsoftteams/teams-end-to-end-encryption"},{"@type":"CreativeWork","name":"Using end-to-end encryption (E2EE) in Zoom meetings","url":"https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0065408"},{"@type":"CreativeWork","name":"Enabling end-to-end (E2EE) encryption for Zoom Phone","url":"https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0059027"},{"@type":"CreativeWork","name":"Security Features, RingCentral Trust Center","url":"https://www.ringcentral.com/trust-center/secure-features.html"},{"@type":"CreativeWork","name":"Webex Calling Security White Paper","url":"https://www.cisco.com/c/en/us/products/collateral/conferencing/webex-control-hub/white-paper-c11-743446.html"}]}}}