WarmTransfer
ccaas platforms · published

UCaaS and CCaaS procurement and RFP evaluation

Verified 2026-09-24 · 51 sources · tier 1–3

Federal regulations, commercial standards, and vendor-specific service level agreements (SLAs) define the evaluation criteria used in unified communications and contact center source selections 25​14. Procurement processes across these platforms require balancing cost, non-cost quality factors, uptime commitments, and statutory compliance frameworks 25​26​10.

Federal Acquisition Regulation (FAR) Evaluation Framework

FAR 15.304(a) and (b) require evaluation factors to be tailored to the acquisition and to represent key areas of importance that support meaningful comparison of proposals 21. Price or cost to the Government must be evaluated in every source selection, subject to narrow multiple-award exceptions for certain agencies 25. Additionally, FAR 15.304(c)(2) requires product or service quality to be addressed in every source selection through non-cost factors such as technical excellence and past performance 26.

Past performance must be evaluated in negotiated competitive acquisitions above the simplified acquisition threshold unless the contracting officer documents why it is not appropriate 24. A solicitation must state whether all non-cost evaluation factors combined are significantly more important than, approximately equal to, or significantly less important than cost or price 27.

For information and communication technology (ICT), FAR 39.203(a) requires agencies acquiring ICT supplies and services to meet the ICT accessibility standards at 36 CFR 1194.1 unless an exception or exemption applies 22. FAR 39.204 exempts national security systems and contractor-internal ICT from the Section 508 acquisition requirement 23. Section508.gov defines an Accessibility Conformance Report (ACR) as a document explaining how an ICT product conforms to the Revised 508 Standards, noting that federal buyers use ACRs during market research and proposal evaluation 1. To produce an ACR for ICT marketed to the federal government, Section508.gov points vendors to the Voluntary Product Accessibility Template (VPAT) 2.

Under government-wide contracts, GSA's Enterprise Infrastructure Solutions (EIS) is a multiple-award IDIQ contract with a $50 billion ceiling open to federal and tribal agencies 18. EIS lists contact center services and voice services among its offerings 17. EIS Option Period 1 runs August 1, 2022 to July 31, 2027, and Option Period 2 runs August 1, 2027 to July 30, 2032 19.

Vendor SLAs and Uptime Commitments

The Amazon Connect Customer SLA commits to a Monthly Uptime Percentage of 99.99% 14. WarmTransfer's reading of the sources is that a 99.99% monthly uptime commitment allows roughly 4.3 minutes of unavailability in a 30-day month before the first credit tier applies 48. Under this SLA, service credits scale according to monthly uptime percentages 10​9​8:

Monthly Uptime Percentage Service Credit
Below 99.99% but at least 99.0% 10 5% 10
Below 99.0% but at least 95.0% 9 15% 9
Below 95.0% 8 100% 8

An Amazon Connect SLA credit request must be received by the end of the 2nd billing cycle after the incident occurred 7. The Amazon Connect SLA excludes downtime caused by factors outside AWS control, customer configuration or equipment, failure to follow AWS documentation, and AWS suspension of the customer's right to use the service 12.

WarmTransfer's reading of the sources is that headline uptime percentages are not comparable across CCaaS bids without normalising each SLA's eligibility conditions, exclusions and credit caps, because at least 1 major SLA ties credits to a paid support tier 49.

Other vendors structure documentation and commitments differently:

  • Genesys markets Genesys Cloud with a 99.99% uptime SLA offering up to a 100% credit and attributes the commitment to the Genesys Cloud Service Level Agreement, 2025 38. Genesys states that Genesys Cloud runs in 21 regions (17 core and 4 satellite media regions) with at least 3 availability zones per region 37.
  • Microsoft publishes the Service Level Agreement for Microsoft Online Services as dated downloadable documents, with September 2026 being the most recent English version listed on the licensing page on 2026-09-24 44.

Compliance and Security Evaluation Factors

FedRAMP

FedRAMP brand guidance names 2 designations: FedRAMP Certified (Rev5), a point-in-time paperwork-based assessment, and FedRAMP Validated (20x), persistent validation of security posture 32. As of its September 13, 2026 update, FedRAMP.gov reported 533 total certified services, 30 of which were FedRAMP 20x 30. WarmTransfer's reading of the sources is that federal RFPs that require a UCaaS or CCaaS offering to be 'FedRAMP Moderate' should also accept the offering's current marketplace designation, and name the equivalent, because the Low, Moderate and High labels are being replaced 31.

HIPAA

Under 45 CFR 164.504, specific requirements govern business associate contracts for handling Protected Health Information (PHI) 39​42:

  • Subcontractors handling PHI must agree to the same restrictions and conditions that apply to the business associate 42.
  • The business associate must report uses or disclosures not provided for by the contract, including breaches of unsecured PHI under 164.410 39.
  • At termination, the business associate must return or destroy all PHI if feasible, or extend contract protections to any retained PHI 40.
  • Internal practices, books, and records on PHI use and disclosure must be made available to the HHS Secretary 41.
  • The covered entity must be authorized to terminate the contract if the business associate violates a material term 43.

AWS lists Amazon Connect as a HIPAA Eligible Service, and lists Amazon Connect Health separately with the Healthcare and Life Sciences Addendum applying 5. Customers must enter into an AWS business associate agreement before using HIPAA Eligible Services, including Amazon Connect, with PHI 4. AWS states that its new sign-up experience is not designed for regulated workloads and that such customers should sign up for AWS (advanced) or activate advanced features 6. AWS directs Amazon Connect customers to download third-party audit reports via AWS Artifact and check the AWS Services in Scope by Compliance Program page 3. WarmTransfer's reading of the sources is that HIPAA eligibility of a CCaaS service does not make a deployment compliant: AWS states that customers remain responsible for their own HIPAA compliance, so an RFP should score the vendor's BAA terms and the buyer's configuration duties separately 20.

GDPR

Under GDPR Article 28, processor engagements must meet specific statutory requirements 35​36:

  • Processors may only process personal data on documented instructions from the controller, including instructions regarding transfers to 3rd countries 35.
  • A processor cannot engage another processor without prior specific or general written authorization from the controller, and under general authorization must inform the controller of changes so the controller can object 36.
  • Contracts must oblige the processor to delete or return all personal data at the end of services and delete existing copies unless EU or Member State law requires storage 34.
  • Processors must make available all information needed to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections 33.

PCI DSS

PCI DSS v4.0.1 was published in June 2024 as a limited revision with no new or deleted requirements, replacing v4.0 which retired on December 31, 2024 45. PCI DSS v4.0.1 maintained March 31, 2025 as the effective date for future-dated v4.0 requirements 46. The revision also clarified Requirement 12 concerning the relationship between customers and third-party service providers (TPSPs) 47.

SOC 2 and CSA STAR

AICPA SOC 2 examinations report on controls across 5 Trust Services categories: security, availability, processing integrity, confidentiality, and privacy 50. WarmTransfer's reading of the sources is that because AICPA describes SOC 2 reports as restricted-use reports for users assessing outsourcing risk, vendors typically release them under NDA rather than publicly 51.

Under the Cloud Security Alliance (CSA) Security, Trust, Assurance and Risk (STAR) program, Level 1 is a self-assessment submitted as a Consensus Assessments Initiative Questionnaire (CAIQ) based on the Cloud Controls Matrix 15. Level 2 requires a 3rd-party audit through STAR Attestation (SOC 2-based), STAR Certification (ISO/IEC 27001-based), or C-STAR 15. CSA states that STAR Attestation expires after 1 year, whereas STAR Certification and C-STAR are valid for 3 years 16.

Applicability

Applies to: US federal government Federal Acquisition Regulation, Amazon Web Services Amazon Connect, US federal government Section 508 program, US federal government GSA EIS contract vehicle, UCaaS, Genesys Cloud, Microsoft Online Services, US federal government FedRAMP, US HHS HIPAA Privacy Rule, EU GDPR, PCI SSC PCI DSS, AICPA SOC 2, and Cloud Security Alliance CSA STAR. Deployments: multi-tenant, any, and dedicated. Sources checked 2026-09-24. PCI DSS provisions reflect edition v4.0.1 45. CSA STAR Level 1 provisions reflect CAIQ v4 15.

What remains uncertain

UCaaS and CCaaS per-seat pricing and TCO benchmarks are not covered by the sources below. Resolution of the FedRAMP designation scheme regarding classes versus numbered levels is not covered by the sources below. Third-party vendor SLA terms from vendor trust portals are not covered by the sources below. EU Data Act cloud switching and exit-charge rules for SaaS contracts are not covered by the sources below. Contractual SLA pages for other UCaaS and CCaaS vendors are not covered by the sources below. The Genesys Cloud Service Level Agreement 2025 contractual document terms are not covered by the sources below. The effect of any FAR overhaul on source-selection text is not covered by the sources below. Amazon Connect's specific scope in the AWS Services in Scope by Compliance Program page regarding PCI and FedRAMP is not covered by the sources below.

See also

Referenced by

Sources

  1. 1
    Section508.gov defines an Accessibility Conformance Report as a document explaining how an ICT product conforms to the Revised 508 Standards, and says federal buyers use ACRs during market research and proposal evaluation.
    Accessibility Conformance Report (ACR) | Section508.gov · introductory section of ACR page · Checked 2026-09-24
  2. 2
    Section508.gov points vendors to the VPAT (Voluntary Product Accessibility Template) as the way to produce an ACR for ICT marketed to the federal government.
    Accessibility Conformance Report (ACR) | Section508.gov · How to Create an ACR link section · Checked 2026-09-24
  3. 3
    AWS directs Amazon Connect customers to download third-party audit reports through AWS Artifact and to check the AWS Services in Scope by Compliance Program page for program coverage.
    Compliance validation in Connect Customer · Compliance validation in Connect Customer, paragraphs 2-3 · Checked 2026-09-24
  4. 4
    AWS requires customers to enter into an AWS business associate agreement before using HIPAA Eligible Services, including Amazon Connect, with Protected Health Information.
    HIPAA Eligible Services Reference · introductory paragraph of HIPAA Eligible Services Reference · Checked 2026-09-24
  5. 5
    AWS lists Amazon Connect as a HIPAA Eligible Service, and lists Amazon Connect Health separately with the Healthcare and Life Sciences Addendum applying.
    HIPAA Eligible Services Reference · HIPAA Eligible Services list, Amazon Connect entries · Checked 2026-09-24
  6. 6
    AWS states that its new sign-up experience is not designed for regulated workloads and that such customers should sign up for AWS (advanced) or activate advanced features.
    Compliance validation in Connect Customer · Compliance validation in Connect Customer, first paragraph · Checked 2026-09-24
  7. 7
    An Amazon Connect SLA credit request must be received by the end of the second billing cycle after the incident occurred.
    Amazon Connect Customer Service Level Agreement · Credit Request and Payment Procedures section · Checked 2026-09-24
  8. 8
    Under the Amazon Connect Customer SLA a Monthly Uptime Percentage below 95.0% earns a 100% service credit.
    Amazon Connect Customer Service Level Agreement · Service Credits table, third row · Checked 2026-09-24
  9. 9
    Under the Amazon Connect Customer SLA a Monthly Uptime Percentage below 99.0% but at least 95.0% earns a 15% service credit.
    Amazon Connect Customer Service Level Agreement · Service Credits table, second row · Checked 2026-09-24
  10. 10
    Under the Amazon Connect Customer SLA a Monthly Uptime Percentage below 99.99% but at least 99.0% earns a 5% service credit.
    Amazon Connect Customer Service Level Agreement · Service Credits table, first row · Checked 2026-09-24
  11. 11
    The Amazon Connect Customer SLA lists as a requirement that the customer maintain an AWS Enterprise Support plan, including completion of a Well-Architected Review with an AWS Solutions Architect.
    Amazon Connect Customer Service Level Agreement · Amazon Connect Customer SLA Exclusions and Requirements section · Checked 2026-09-24
  12. 12
    The Amazon Connect SLA excludes from credit downtime caused by factors outside AWS control, customer configuration or equipment, failure to follow AWS documentation, and AWS suspension of the customer's right to use the service.
    Amazon Connect Customer Service Level Agreement · Amazon Connect Customer SLA Exclusions and Requirements section · Checked 2026-09-24
  13. 13
    The Amazon Connect Customer SLA requirements include using Amazon as the RespOrg for toll-free numbers where that option is available.
    Amazon Connect Customer Service Level Agreement · Amazon Connect Customer SLA Exclusions and Requirements section · Checked 2026-09-24
  14. 14
    The Amazon Connect Customer SLA commits to a Monthly Uptime Percentage of 99.99%.
    Amazon Connect Customer Service Level Agreement · Service Commitment section · Checked 2026-09-24
  15. 15
    CSA STAR Level 1 is a self-assessment submitted as a CAIQ based on the Cloud Controls Matrix; Level 2 requires third-party audit via STAR Attestation (SOC 2-based), STAR Certification (ISO/IEC 27001-based) or C-STAR.
    Security, Trust, Assurance and Risk (STAR) · Level 1 and Level 2 sections · Checked 2026-09-24
  16. 16
    CSA states that STAR Attestation expires after one year, while STAR Certification and C-STAR are valid for three years.
    Security, Trust, Assurance and Risk (STAR) · Level 2 section · Checked 2026-09-24
  17. 17
    GSA's Enterprise Infrastructure Solutions (EIS) contract lists contact center services and voice services among its offerings.
    Enterprise Infrastructure Solutions | GSA · service offerings paragraph · Checked 2026-09-24
  18. 18
    EIS is a multiple-award IDIQ contract with a $50 billion ceiling open to federal and tribal agencies.
    Enterprise Infrastructure Solutions | GSA · key details section · Checked 2026-09-24
  19. 19
    EIS Option Period 1 runs August 1, 2022 to July 31, 2027 and Option Period 2 runs August 1, 2027 to July 30, 2032.
    Enterprise Infrastructure Solutions | GSA · contract period section · Checked 2026-09-24
  20. 20
    HIPAA eligibility of a CCaaS service does not make a deployment compliant: AWS states that customers remain responsible for their own HIPAA compliance, so an RFP should score the vendor's BAA terms and the buyer's configuration duties separately.inferred
    HIPAA Eligible Services Reference · introductory paragraph of HIPAA Eligible Services Reference · Checked 2026-09-24
  21. 21
    FAR 15.304(a) and (b) require evaluation factors to be tailored to the acquisition and to represent key areas of importance that support meaningful comparison of proposals.
    15.304 Evaluation factors and significant subfactors · FAR 15.304(a)-(b) · Checked 2026-09-24
  22. 22
    FAR 39.203(a) requires agencies acquiring ICT supplies and services to meet the ICT accessibility standards at 36 CFR 1194.1 unless an exception or exemption applies.
    Subpart 39.2 - Information and Communication Technology · FAR 39.203(a) · Checked 2026-09-24
  23. 23
    FAR 39.204 exempts national security systems and contractor-internal ICT from the Section 508 acquisition requirement.
    Subpart 39.2 - Information and Communication Technology · FAR 39.204 · Checked 2026-09-24
  24. 24
    FAR 15.304(c)(3) requires past performance to be evaluated in negotiated competitive acquisitions above the simplified acquisition threshold unless the contracting officer documents why it is not appropriate.
    15.304 Evaluation factors and significant subfactors · FAR 15.304(c)(3) · Checked 2026-09-24
  25. 25
    FAR 15.304(c)(1) requires price or cost to the Government to be evaluated in every source selection, subject to narrow multiple-award exceptions for certain agencies.
    15.304 Evaluation factors and significant subfactors · FAR 15.304(c)(1) · Checked 2026-09-24
  26. 26
    FAR 15.304(c)(2) requires the quality of the product or service to be addressed in every source selection through non-cost factors such as past performance and technical excellence.
    15.304 Evaluation factors and significant subfactors · FAR 15.304(c)(2) · Checked 2026-09-24
  27. 27
    FAR 15.304(e) requires a solicitation to state whether all non-cost evaluation factors combined are significantly more important than, approximately equal to, or significantly less important than cost or price.
    15.304 Evaluation factors and significant subfactors · FAR 15.304(e) · Checked 2026-09-24
  28. 28
    FedRAMP's marketplace brand guidance maps legacy designations to four classes: Class A replaces FedRAMP Ready, Class B replaces Low, Class C replaces Moderate and Class D replaces High.disputed
    FedRAMP Marketplace Designations | Brand Guidelines · Classes section · Checked 2026-09-24
  29. 29
    FedRAMP RFC-0020 proposes that each designation carry numbered levels 1 through 6 in place of Low, Moderate and High, with a tentative transition date of March 18, 2026.disputed
    RFC-0020 FedRAMP Authorization Designations · designation levels and transition sections · Checked 2026-09-24
  30. 30
    FedRAMP.gov reported 533 total certified services, 30 of them FedRAMP 20x, as of its September 13, 2026 update.
    FedRAMP | FedRAMP.gov · marketplace statistics panel · Checked 2026-09-24
  31. 31
    Federal RFPs that require a UCaaS or CCaaS offering to be 'FedRAMP Moderate' should also accept the offering's current marketplace designation, and name the equivalent, because the Low, Moderate and High labels are being replaced.inferred
    FedRAMP Marketplace Designations | Brand Guidelines · Classes section · Checked 2026-09-24
  32. 32
    FedRAMP's marketplace brand guidance names two designations: FedRAMP Certified (Rev5), a point-in-time paperwork-based assessment, and FedRAMP Validated (20x), persistent validation of security posture.
    FedRAMP Marketplace Designations | Brand Guidelines · Marketplace Designations section · Checked 2026-09-24
  33. 33
    GDPR Article 28(3)(h) requires the processor to make available all information needed to demonstrate compliance with Article 28 and to allow for and contribute to audits, including inspections.
    Regulation (EU) 2016/679 General Data Protection Regulation · Article 28(3)(h) · Checked 2026-09-24
  34. 34
    GDPR Article 28(3)(g) requires the processor contract to oblige the processor to delete or return all personal data at the end of the services and delete existing copies unless EU or Member State law requires storage.
    Regulation (EU) 2016/679 General Data Protection Regulation · Article 28(3)(g) · Checked 2026-09-24
  35. 35
    GDPR Article 28(3)(a) requires the processor to process personal data only on documented instructions from the controller, including instructions on transfers to third countries.
    Regulation (EU) 2016/679 General Data Protection Regulation · Article 28(3)(a) · Checked 2026-09-24
  36. 36
    GDPR Article 28(2) bars a processor from engaging another processor without the controller's prior specific or general written authorisation; under general authorisation the processor must inform the controller of changes so the controller can object.
    Regulation (EU) 2016/679 General Data Protection Regulation · Article 28(2) · Checked 2026-09-24
  37. 37
    Genesys states that Genesys Cloud runs in 21 regions, 17 core and four satellite media regions, with at least three availability zones per region.
    Genesys Cloud Platform Global Availability Capabilities · regions section of Global Availability page · Checked 2026-09-24
  38. 38
    Genesys markets Genesys Cloud with a 99.99% uptime SLA offering up to a 100% credit and attributes the commitment to the Genesys Cloud Service Level Agreement, 2025.
    Genesys Cloud Platform Global Availability Capabilities · uptime SLA callout on Global Availability page · Checked 2026-09-24
  39. 39
    45 CFR 164.504(e)(2)(ii)(C) requires the business associate to report uses or disclosures not provided for by the contract, including breaches of unsecured PHI as required by 164.410.
    45 CFR § 164.504 - Uses and disclosures: Organizational requirements · 45 CFR 164.504(e)(2)(ii)(C) · Checked 2026-09-24
  40. 40
    45 CFR 164.504(e)(2)(ii)(J) requires the business associate, at termination, to return or destroy all PHI if feasible, or else extend the contract's protections to any PHI it retains.
    45 CFR § 164.504 - Uses and disclosures: Organizational requirements · 45 CFR 164.504(e)(2)(ii)(J) · Checked 2026-09-24
  41. 41
    45 CFR 164.504(e)(2)(ii)(I) requires the business associate to make its internal practices, books and records on PHI use and disclosure available to the HHS Secretary.
    45 CFR § 164.504 - Uses and disclosures: Organizational requirements · 45 CFR 164.504(e)(2)(ii)(I) · Checked 2026-09-24
  42. 42
    45 CFR 164.504(e)(2)(ii)(D) requires a business associate contract to ensure that subcontractors handling PHI agree to the same restrictions and conditions that apply to the business associate.
    45 CFR § 164.504 - Uses and disclosures: Organizational requirements · 45 CFR 164.504(e)(2)(ii)(D) · Checked 2026-09-24
  43. 43
    45 CFR 164.504(e)(2)(iii) requires the business associate contract to authorise the covered entity to terminate it if the business associate violates a material term.
    45 CFR § 164.504 - Uses and disclosures: Organizational requirements · 45 CFR 164.504(e)(2)(iii) · Checked 2026-09-24
  44. 44
    Microsoft publishes the Service Level Agreement for Microsoft Online Services as dated downloadable documents, with September 2026 the most recent English version listed on the licensing page on 2026-09-24.
    Service Level Agreements (SLA) for Online Services · version listing on SLA for Online Services page · Checked 2026-09-24
  45. 45
    PCI DSS v4.0.1, published June 2024 as a limited revision with no new or deleted requirements, replaced v4.0, which retired on December 31, 2024.
    Just Published: PCI DSS v4.0.1 · post body and timeline section · Checked 2026-09-24
  46. 46
    PCI DSS v4.0.1 kept March 31, 2025 as the effective date for the v4.0 requirements that had been future-dated.
    Just Published: PCI DSS v4.0.1 · timeline section · Checked 2026-09-24
  47. 47
    PCI DSS v4.0.1 clarified Requirement 12 on the relationship between customers and third-party service providers (TPSPs).
    Just Published: PCI DSS v4.0.1 · summary of changes list, Requirement 12 item · Checked 2026-09-24
  48. 48
    A 99.99% monthly uptime commitment allows roughly 4.3 minutes of unavailability in a 30-day month before the first credit tier applies.inferred
    Amazon Connect Customer Service Level Agreement · Service Commitment section (arithmetic: 0.01% of 43,200 minutes) · Checked 2026-09-24
  49. 49
    Headline uptime percentages are not comparable across CCaaS bids without normalising each SLA's eligibility conditions, exclusions and credit caps, because at least one major SLA ties credits to a paid support tier.inferred
    Amazon Connect Customer Service Level Agreement · Amazon Connect Customer SLA Exclusions and Requirements section · Checked 2026-09-24
  50. 50
    AICPA SOC 2 examinations report on controls relevant to five Trust Services categories: security, availability, processing integrity, confidentiality and privacy.
    SOC 2 - SOC for Service Organizations: Trust Services Criteria · SOC 2 overview section · Checked 2026-09-24
  51. 51
    AICPA describes SOC 2 reports as restricted-use reports for users who need to assess outsourcing risk, which is why vendors typically release them under NDA rather than publicly.inferred
    SOC 2 - SOC for Service Organizations: Trust Services Criteria · SOC 2 overview section · Checked 2026-09-24

Documents

tier 1 standards and regulators

15.304 Evaluation factors and significant subfactors

GSA / FAR Council (acquisition.gov) · 2026-03-13 · accessed 2026-09-24

tier 1 standards and regulators

45 CFR § 164.504 - Uses and disclosures: Organizational requirements

Cornell Law School Legal Information Institute · accessed 2026-09-24

tier 1 standards and regulators

Accessibility Conformance Report (ACR) | Section508.gov

GSA Section508.gov · accessed 2026-09-24

tier 1 standards and regulators

Enterprise Infrastructure Solutions | GSA

US General Services Administration · 2026-09-18 · accessed 2026-09-24

tier 1 standards and regulators

FedRAMP | FedRAMP.gov

FedRAMP (GSA) · 2026-09-13 · accessed 2026-09-24

tier 1 standards and regulators

FedRAMP Marketplace Designations | Brand Guidelines

FedRAMP (GSA) · accessed 2026-09-24

tier 1 standards and regulators

Just Published: PCI DSS v4.0.1

PCI Security Standards Council · 2024-06-11 · accessed 2026-09-24

tier 1 standards and regulators

Regulation (EU) 2016/679 General Data Protection Regulation

Publications Office of the European Union (EUR-Lex) · 2016-04-27 · accessed 2026-09-04

tier 1 standards and regulators

RFC-0020 FedRAMP Authorization Designations

FedRAMP (GSA) · accessed 2026-09-24

tier 1 standards and regulators

SOC 2 - SOC for Service Organizations: Trust Services Criteria

AICPA & CIMA · accessed 2026-09-24

tier 1 standards and regulators

Subpart 39.2 - Information and Communication Technology

GSA / FAR Council (acquisition.gov) · 2026-03-13 · accessed 2026-09-24

tier 2 current vendor documentation

Amazon Connect Customer Service Level Agreement

Amazon Web Services · 2026-04-28 · accessed 2026-09-24

tier 2 current vendor documentation

Compliance validation in Connect Customer

Amazon Web Services · accessed 2026-09-24

tier 2 current vendor documentation

Genesys Cloud Platform Global Availability Capabilities

Genesys · accessed 2026-09-24

tier 2 current vendor documentation

HIPAA Eligible Services Reference

Amazon Web Services · 2026-09-03 · accessed 2026-09-24

tier 2 current vendor documentation

Service Level Agreements (SLA) for Online Services

Microsoft · accessed 2026-09-24

tier 3 vendor-maintained repositories

Security, Trust, Assurance and Risk (STAR)

Cloud Security Alliance · accessed 2026-09-24

Cite this page

APA

WarmTransfer. (2026, September 24). UCaaS and CCaaS procurement and RFP evaluation. WarmTransfer. https://warmtransfer.net/knowledge/ucaas-ccaas-procurement

BibTeX

@misc{warmtransfer-ucaas-ccaas-procurement,
  title  = {UCaaS and CCaaS procurement and RFP evaluation},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/ucaas-ccaas-procurement},
  note   = {Verified 2026-09-24}
}