# UC and CCaaS security certifications

Canonical: https://warmtransfer.net/knowledge/ucaas-compliance-certifications

Last verified: 2026-10-02

FedRAMP Certification Classes describe the level of assurance information a cloud service provider supplies through FedRAMP for a cloud service offering, and FedRAMP states they are not aligned to how secure that offering is[^16][^18]. The other schemes covered here differ in form: BSI C5 produces attestations rather than certificates, AICPA treats SOC 3 reports as freely distributable general use reports, and HITRUST certifications are valid for 1 or 2 years depending on the assessment[^3][^50][^35][^38].

## FedRAMP under the Consolidated Rules for 2026

FedRAMP defines 4 Certification Classes, labelled A, B, C and D[^22]. Certification Classes measure the depth of assurance information supplied, not how secure a cloud service offering is[^18]. FedRAMP tells agencies not to treat Certification Classes as one-for-one replacements for the Low, Moderate or High FIPS 199 impact levels[^17].

FedRAMP presumes Class A adequate only for pilots, testing, or extremely low or negligible risk use cases[^14]. Class C is presumed adequate for most Low and Moderate systems and only some High systems with compensating controls, while Class D is presumed adequate for most agency information systems regardless of impact level[^15].

The 2026 rules also change terminology:[^29][^30]

- A FedRAMP authorization is renamed a FedRAMP Certification so that it is not confused with an agency authorization to operate[^29].
- Continuous monitoring is replaced by Ongoing Certification[^30].
- The System Security Plan is replaced by a Certification Package Overview and Security Decision Record[^30].

### Key dates

| Date | Event |
|---|---|
| 4 July 2026 | Consolidated Rules for 2026 take effect for optional, incremental adoption[^20] |
| 28 July 2026 | Last date FedRAMP accepted FedRAMP Ready submissions; providers are directed to FedRAMP 20x Class A Certification instead[^26] |
| 3 August 2026 | FedRAMP 20x Class A applications accepted[^12] |
| 31 August 2026 | FedRAMP 20x Class B and C applications accepted[^12] |
| 1 January 2027 | Consolidated Rules for 2026 mandatory for all stakeholders, subject to area-specific effective dates[^19] |
| 11 June 2027 | No new FedRAMP Rev5 Certification applications accepted[^28] |
| 31 December 2028 | Existing FedRAMP Rev5 Certifications remain active until at least this date[^27] |

## What a FedRAMP authorization covers

A FedRAMP authorization attaches to a specific Cloud Service Offering that the FedRAMP PMO approves for the Marketplace, not to the vendor as a whole[^21]. Under OMB M-24-15, agencies must presume that the security assessment in a FedRAMP authorization package is adequate for their use at the impact level it was authorized for[^25]. A FedRAMP authorization does not replace an agency's own decision, because agencies use the FedRAMP package to issue their own authorization to operate or authorization to use[^13].

Since August 2024 FedRAMP no longer distinguishes JAB and agency authorization tiers; every authorized provider is designated FedRAMP Authorized regardless of path[^24]. Providers that had received a JAB authorization keep that historic status in their FedRAMP Marketplace description, with continuous monitoring moving to GSA, DoD, DHS, FedRAMP or agency customers[^23].

WarmTransfer's reading of the sources is that a FedRAMP listing held by a vendor's government offering, such as Webex for Government, Zoom for Government or Office 365 GCC, should not be read as covering that vendor's commercial multi-tenant service[^31].

## Vendor government offerings

### Cisco

Cisco's data sheet describes Webex Contact Center Enterprise for Government as a FedRAMP Moderate authorized cloud contact center operated by Cisco in FedRAMP-authorized data centers[^52]. Webex Contact Center Enterprise for Government is offered exclusively to United States federal and state agencies[^53]. Cisco announced in October 2023 that Webex Calling within the Webex for Government platform is FedRAMP Moderate authorized and served from US data centers[^51].

### Zoom

Zoom announced that Zoom Contact Center for Zoom for Government received a FedRAMP JAB authorization at the Moderate level on 4 June 2024[^57]. Zoom lists Zoom Phone among the Zoom for Government products covered by its FedRAMP authorization[^59]. Zoom says Zoom for Government runs on AWS GovCloud, is managed by U.S. persons, and was first FedRAMP authorized in March 2019[^58].

### Microsoft

Microsoft lists Microsoft Teams as an in-scope FedRAMP service in each of the Office 365 GCC, GCC High and DoD environments[^47]. Office 365 U.S. Government GCC and GCC High hold ATOs from US agencies, while Office 365 U.S. Government Defense holds a provisional ATO from DISA[^45]. Office 365 GCC is listed on the FedRAMP Marketplace under the name Office 365 (Commercial), also called Office 365 Multitenant, even though it is the government community environment[^46]. Microsoft states that customers can build on its FedRAMP certifications for an agency ATO but must achieve their own authorizations for components outside Microsoft's services[^43].

## GovRAMP

StateRAMP announced on 14 February 2025 that it would operate under the name GovRAMP[^33]. StateRAMP remains the legal entity doing business as GovRAMP, and existing contracts and memberships continued without interruption after the rename[^32].

## SOC 2 and SOC 3

SOC 2 and SOC 3 reports address controls relevant to 5 categories: security, availability, processing integrity, confidentiality and privacy[^48]. AICPA treats SOC 3 reports as general use reports that can be freely distributed because they carry less detail than SOC 2 reports[^50]. A SOC 2 Type 1 report examines whether controls are suitably designed, while a Type 2 report also tests the operating effectiveness of the controls during the reporting period[^49].

## ISO/IEC 27701:2025

ISO/IEC 27701:2025 was published in October 2025 and replaces ISO/IEC 27701:2019, which was an extension to ISO/IEC 27001[^41]. ISO/IEC 27701:2025 is a stand-alone privacy information management system standard whose application no longer depends on implementing ISO/IEC 27001 or 27002[^42]. It uses the harmonized clause 4 to 10 management system structure and splits its Annex A and B controls between PII controllers and PII processors[^40].

## BSI C5

BSI C5 produces attestations, not certificates, and the BSI currently operates no C5 certification programme[^3]. Only auditors may issue a C5 attestation, and the audit team's qualifications, such as CISA, CISM, CCSK or ISO 27001 auditor, must be listed in the attestation[^4]. The BSI does not supervise C5 audits or check C5 reports; it publishes the criteria but takes no part in testing or approving attestations[^6].

A C5 attestation always refers to a completed past period, which under ISAE 3000 covers 3 to 12 months, and it carries no forward validity date[^9]. The BSI says a C5 Type 2 audit, which shows operating effectiveness over an audit period, is required for an appropriate informative value, whereas Type 1 only shows design at a point in time[^11]. Every C5 attestation must cover at least all basic criteria, while additional criteria tighten or complement them and are covered only if the provider includes them[^5].

C5:2020 has 121 criteria in 17 subject areas, and C5:2026 has 168 criteria with added sub-criteria[^7]. The C5:2026 criteria apply to engagements dated after 1 June 2027, with earlier adoption permitted[^2].

German federal agencies must request C5 evidence for external cloud services[^8]. Since 1 July 2024, section 393 of SGB V requires German healthcare cloud use to be backed by a C5 attestation or comparable certificate, and the Federal Ministry of Health, not the BSI, interprets that requirement[^10].

## HITRUST

HITRUST e1, i1 and r2 are all built on the HITRUST CSF, and work from an e1 or i1 can be applied toward a more comprehensive i1 or r2[^39].

| Assessment | Scope as HITRUST describes it | Validity |
|---|---|---|
| e1 | 43 core controls aimed at foundational cybersecurity[^34] | 1 year[^35] |
| i1 | 182 control requirements[^36] | 1 year[^37] |
| r2 | Not covered by any claim in this article | 2 years, with an interim assessment after the first year[^38] |

See also [HIPAA for contact centers and UC](https://warmtransfer.net/knowledge/hipaa-contact-center).

## Commercial trust centres

Zoom's trust center lists PCI DSS for Zoom Phone and Zoom Contact Center rather than for the whole platform[^55]. Zoom describes its SOC 2 Type 2 report as covering Security, Availability, Confidentiality and Privacy[^56]. Zoom's trust center lists BSI C5 and an IRAP assessment among its commercial attestations, alongside FedRAMP Moderate, GovRAMP, TX-RAMP and DoD IL4 in its government section[^54].

AWS directs Amazon Connect customers to the AWS Services in Scope by Compliance Program page to check scope, and to AWS Artifact to download third-party audit reports[^1].

See also [PCI DSS for contact centers](https://warmtransfer.net/knowledge/pci-dss-contact-center).

See also [UCaaS and CCaaS procurement and RFP evaluation](https://warmtransfer.net/knowledge/ucaas-ccaas-procurement).

## Applicability

Applies to: GSA FedRAMP, BSI C5, AICPA SOC 3, HITRUST e1, HITRUST r2, Cisco Webex Contact Center Enterprise for Government, Cisco Webex Calling, Zoom Contact Center, Zoom Phone, Zoom for Government, Microsoft Teams, Microsoft Office 365 U.S. Government, StateRAMP GovRAMP, AICPA SOC 2, ISO 27701, HITRUST CSF, HITRUST i1, Zoom Workplace, and AWS Amazon Connect. Deployments: cloud and multi-tenant. Sources checked 2026-10-02. The FedRAMP material reflects the Consolidated Rules for 2026, which become mandatory on 1 January 2027 subject to area-specific effective dates[^19]. Existing FedRAMP Rev5 Certifications remain active until at least 31 December 2028[^27]. Webex Contact Center Enterprise for Government is offered exclusively to United States federal and state agencies[^53]. Microsoft's Teams scope statement covers the Office 365 GCC, GCC High and DoD environments[^47]. The ISO/IEC 27701 material covers the 2025 edition published in October 2025[^41]. The C5 material covers C5:2020 and C5:2026, with C5:2026 applying to engagements dated after 1 June 2027[^7][^2].

## What remains uncertain

Sources disagree on FedRAMP authorization paths: Microsoft's FedRAMP compliance page (updated September 2026) still presents a JAB provisional ATO as a current path and describes FedRAMP authorizations as granted at 3 impact levels[^44], whereas since August 2024 FedRAMP no longer distinguishes JAB and agency authorization tiers[^24]. Cisco's government statements come from a data sheet updated in 2023 and an announcement dated October 2023[^52][^51], so verify current status directly. How existing vendor FedRAMP authorizations will be expressed as Certification Classes under the 2026 rules is not covered by the sources below. The current FedRAMP Marketplace status of the government offerings named here, beyond the vendors' own statements, is not covered by the sources below. Which security certifications the commercial, non-government editions of the UC and CCaaS products named here hold, beyond the Zoom trust center listings, is not covered by the sources below.

## Sources

[^1]: AWS directs Amazon Connect customers to the AWS Services in Scope by Compliance Program page to check scope, and to AWS Artifact to download third-party audit reports. Source: [Compliance validation in Connect Customer](https://docs.aws.amazon.com/connect/latest/adminguide/compliance-validation.html), page body, second and third paragraphs. Checked 2026-10-02.
[^2]: The C5:2026 criteria apply to engagements dated after 1 June 2027, with earlier adoption permitted. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'When shall the criteria of C5:2026 be applied?'. Checked 2026-10-02.
[^3]: BSI C5 produces attestations, not certificates; the BSI currently operates no C5 certification programme. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'What is the difference between an attestation and a certificate?'. Checked 2026-10-02.
[^4]: Only auditors may issue a C5 attestation, and the audit team's qualifications such as CISA, CISM, CCSK or ISO 27001 auditor must be listed in the attestation. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'Who is authorised to issue a C5 attestation?'. Checked 2026-10-02.
[^5]: Every C5 attestation must cover at least all basic criteria; additional criteria tighten or complement them and are covered only if the provider includes them. Source: [C5 introduction](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_Einfuehrung/C5_Einfuehrung_node.html), section on criterion types (basic and additional). Checked 2026-10-02.
[^6]: The BSI does not supervise C5 audits or check C5 reports; it publishes the criteria but takes no part in testing or approving attestations. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'Does the BSI check existing C5 reports?'. Checked 2026-10-02.
[^7]: C5:2020 has 121 criteria in 17 subject areas, and C5:2026 has 168 criteria with added sub-criteria. Source: [C5 introduction](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_Einfuehrung/C5_Einfuehrung_node.html), section on criteria counts. Checked 2026-10-02.
[^8]: German federal agencies must request C5 evidence for external cloud services. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ on areas where fulfilment of the C5 criteria may be required by regulation. Checked 2026-10-02.
[^9]: A C5 attestation always refers to a completed past period, which under ISAE 3000 covers 3 to 12 months; it carries no forward validity date. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'How long is a C5 attestation valid for?'. Checked 2026-10-02.
[^10]: Since 1 July 2024, section 393 of SGB V requires German healthcare cloud use to be backed by a C5 attestation or comparable certificate, and the Federal Ministry of Health, not the BSI, interprets that requirement. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ on areas where fulfilment of the C5 criteria may be required by regulation, healthcare paragraph. Checked 2026-10-02.
[^11]: The BSI says a C5 Type 2 audit, which shows operating effectiveness over an audit period, is required for an appropriate informative value, whereas Type 1 only shows design at a point in time. Source: [C5 introduction](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_Einfuehrung/C5_Einfuehrung_node.html), section on audit types. Checked 2026-10-02.
[^12]: FedRAMP began accepting FedRAMP 20x Class A applications on 3 August 2026 and Class B and C applications on 31 August 2026. Source: [Important Dates - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/timeline/), headings 'August 3, 2026' and 'August 31, 2026'. Checked 2026-10-02.
[^13]: A FedRAMP authorization does not replace an agency's own decision: agencies use the FedRAMP package to issue their own authorization to operate or authorization to use. Source: [The FedRAMP Authorization Process - FedRAMP Consolidated Rules for 2026 (OMB M-24-15 Section IV)](https://www.fedramp.gov/2026/authority/m-24-15/process/), Section IV, footnote 1. Checked 2026-10-02.
[^14]: FedRAMP presumes Class A adequate only for pilots, testing, or extremely low or negligible risk use cases. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), class table, row A. Checked 2026-10-02.
[^15]: FedRAMP presumes Class D adequate for most agency information systems regardless of impact level, whereas Class C is presumed adequate for most Low and Moderate systems and only some High systems with compensating controls. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), class table, rows C and D. Checked 2026-10-02.
[^16]: Under the FedRAMP Consolidated Rules for 2026, a Certification Class describes the level of assurance information a cloud service provider supplies through FedRAMP for a cloud service offering. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), opening definition and section 'Impact Levels vs. Certification Classes'. Checked 2026-10-02.
[^17]: FedRAMP tells agencies not to treat Certification Classes as one-for-one replacements for the Low, Moderate or High FIPS 199 impact levels. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), section 'Broad Considerations on Certification Classes'. Checked 2026-10-02.
[^18]: FedRAMP states that Certification Classes are not aligned to how secure a cloud service offering is; they measure the depth of assurance information supplied. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), section 'Impact Levels vs. Certification Classes'. Checked 2026-10-02.
[^19]: The FedRAMP Consolidated Rules for 2026 become mandatory for all stakeholders on 1 January 2027, subject to area-specific effective dates. Source: [Important Dates - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/timeline/), heading 'January 1, 2027 - Mandatory Adoption'. Checked 2026-10-02.
[^20]: The FedRAMP Consolidated Rules for 2026 took effect for optional, incremental adoption on 4 July 2026. Source: [Important Dates - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/timeline/), heading 'July 4, 2026'. Checked 2026-10-02.
[^21]: A FedRAMP authorization attaches to a specific Cloud Service Offering that the FedRAMP PMO approves for the Marketplace, not to the vendor as a whole. Source: [The FedRAMP Authorization Process - FedRAMP Consolidated Rules for 2026 (OMB M-24-15 Section IV)](https://www.fedramp.gov/2026/authority/m-24-15/process/), Section IV 'The FedRAMP Authorization Process', opening paragraph. Checked 2026-10-02.
[^22]: FedRAMP defines four Certification Classes, labelled A, B, C and D. Source: [Certification Classes - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/agencies/use/classes/), class table (presumption of adequacy by class). Checked 2026-10-02.
[^23]: Providers that had received a JAB authorization keep that historic status in their FedRAMP Marketplace description, with continuous monitoring moving to GSA, DoD, DHS, FedRAMP or agency customers. Source: [Moving to One FedRAMP Authorization: An Update on the JAB Transition](https://www.fedramp.gov/archive/2024-08-12-moving-to-one-fedramp-authorization-an-update-on-the-jab-transition/), section on existing JAB-authorized providers. Checked 2026-10-02.
[^24]: Since August 2024 FedRAMP no longer distinguishes JAB and agency authorization tiers; every authorized provider is designated FedRAMP Authorized regardless of path. Source: [Moving to One FedRAMP Authorization: An Update on the JAB Transition](https://www.fedramp.gov/archive/2024-08-12-moving-to-one-fedramp-authorization-an-update-on-the-jab-transition/), opening paragraphs on moving to one FedRAMP authorization. Checked 2026-10-02.
[^25]: Under OMB M-24-15, agencies must presume that the security assessment in a FedRAMP authorization package is adequate for their use at the impact level it was authorized for. Source: [The FedRAMP Authorization Process - FedRAMP Consolidated Rules for 2026 (OMB M-24-15 Section IV)](https://www.fedramp.gov/2026/authority/m-24-15/process/), Section IV, subsection a 'The Presumption of Adequacy'. Checked 2026-10-02.
[^26]: FedRAMP stopped accepting FedRAMP Ready submissions after 28 July 2026 and directs providers to seek FedRAMP 20x Class A Certification instead. Source: [Important Dates - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/timeline/), heading 'July 28, 2026 - FedRAMP Ready Goes Legacy'. Checked 2026-10-02.
[^27]: Existing FedRAMP Rev5 Certifications remain active until at least 31 December 2028. Source: [What's Changing - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/providers/updating/changes/), key dates list, 'December 31, 2028'. Checked 2026-10-02.
[^28]: FedRAMP will no longer accept applications for new FedRAMP Rev5 Certifications from 11 June 2027. Source: [Important Dates - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/timeline/), heading 'June 11, 2027 - End of New Rev5 Certifications'. Checked 2026-10-02.
[^29]: The 2026 rules rename a FedRAMP authorization to a FedRAMP Certification so that it is not confused with an agency authorization to operate. Source: [What's Changing - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/providers/updating/changes/), terminology table, row 'Authorization -> Certification'. Checked 2026-10-02.
[^30]: The 2026 rules replace the term continuous monitoring with Ongoing Certification and replace the System Security Plan with a Certification Package Overview and Security Decision Record. Source: [What's Changing - FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/providers/updating/changes/), terminology table, rows 'Continuous Monitoring' and 'System Security Plan'. Checked 2026-10-02.
[^31]: A FedRAMP listing held by a vendor's government offering, such as Webex for Government, Zoom for Government or Office 365 GCC, should not be read as covering that vendor's commercial multi-tenant service (inferred). Source: [The FedRAMP Authorization Process - FedRAMP Consolidated Rules for 2026 (OMB M-24-15 Section IV)](https://www.fedramp.gov/2026/authority/m-24-15/process/), Section IV opening paragraph (CSO-level authorization), read with the vendor sources in notes. Checked 2026-10-02.
[^32]: StateRAMP remains the legal entity doing business as GovRAMP, and existing contracts and memberships continued without interruption after the rename. Source: [StateRAMP Announces Rebrand to GovRAMP, Reflecting Mission to Unite Public and Private Sectors in Advancing Cybersecurity](https://govramp.org/news/blog/stateramp-announces-rebrand-to-govramp-reflecting-mission-to-unite-public-and-private-sectors-in-advancing-cybersecurity), paragraph on legal entity and memberships. Checked 2026-10-02.
[^33]: StateRAMP announced on 14 February 2025 that it would operate under the name GovRAMP. Source: [StateRAMP Announces Rebrand to GovRAMP, Reflecting Mission to Unite Public and Private Sectors in Advancing Cybersecurity](https://govramp.org/news/blog/stateramp-announces-rebrand-to-govramp-reflecting-mission-to-unite-public-and-private-sectors-in-advancing-cybersecurity), announcement dateline and first paragraph. Checked 2026-10-02.
[^34]: HITRUST describes the e1 assessment as covering 43 core controls aimed at foundational cybersecurity. Source: [Cybersecurity Compliance Certifications and Assessments](https://hitrustalliance.net/assessments-and-certifications), e1 assessment card. Checked 2026-10-02.
[^35]: A HITRUST e1 validated assessment certification is valid for one year. Source: [Cybersecurity Compliance Certifications and Assessments](https://hitrustalliance.net/assessments-and-certifications), e1 assessment card. Checked 2026-10-02.
[^36]: HITRUST describes the i1 assessment as covering 182 control requirements. Source: [Cybersecurity Compliance Certifications and Assessments](https://hitrustalliance.net/assessments-and-certifications), i1 assessment card. Checked 2026-10-02.
[^37]: A HITRUST i1 validated assessment certification is valid for one year. Source: [Cybersecurity Compliance Certifications and Assessments](https://hitrustalliance.net/assessments-and-certifications), i1 assessment card. Checked 2026-10-02.
[^38]: A HITRUST r2 certification is valid for two years and requires an interim assessment after the first year. Source: [HITRUST r2 Assessment: 2-Year Validated Assurance](https://hitrustalliance.net/assessments-and-certifications/r2), page section on validity. Checked 2026-10-02.
[^39]: HITRUST e1, i1 and r2 are all built on the HITRUST CSF, and work from an e1 or i1 can be applied toward a more comprehensive i1 or r2. Source: [Cybersecurity Compliance Certifications and Assessments](https://hitrustalliance.net/assessments-and-certifications), section on progression and inheritance. Checked 2026-10-02.
[^40]: ISO/IEC 27701:2025 uses the harmonized clause 4 to 10 management system structure and splits its Annex A and B controls between PII controllers and PII processors. Source: [ISO/IEC 27701:2025 key changes and guidance](https://www.bsigroup.com/en-IE/products-and-services/standards-services/iso-iec-27701-key-changes-and-guidance/), section 'What are the changes to ISO/IEC 27701?'. Checked 2026-10-02.
[^41]: ISO/IEC 27701:2025 was published in October 2025 and replaces ISO/IEC 27701:2019, which was an extension to ISO/IEC 27001. Source: [ISO/IEC 27701:2025 key changes and guidance](https://www.bsigroup.com/en-IE/products-and-services/standards-services/iso-iec-27701-key-changes-and-guidance/), section 'What's the status and timing of ISO/IEC 27701 changes?'. Checked 2026-10-02.
[^42]: ISO/IEC 27701:2025 is a stand-alone privacy information management system standard whose application no longer depends on implementing ISO/IEC 27001 or 27002. Source: [ISO/IEC 27701:2025 key changes and guidance](https://www.bsigroup.com/en-IE/products-and-services/standards-services/iso-iec-27701-key-changes-and-guidance/), section 'What's the status and timing of ISO/IEC 27701 changes?'. Checked 2026-10-02.
[^43]: Microsoft states that customers can build on its FedRAMP certifications for an agency ATO but must achieve their own authorizations for components outside Microsoft's services. Source: [Federal Risk and Authorization Management Program (FedRAMP) - Microsoft Compliance](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp), FAQ 'Can I use Microsoft compliance in my agency's authorization process?'. Checked 2026-10-02.
[^44]: Microsoft's FedRAMP compliance page (updated September 2026) still presents a JAB provisional ATO as a current path and describes FedRAMP authorizations as granted at three impact levels (disputed). Source: [Federal Risk and Authorization Management Program (FedRAMP) - Microsoft Compliance](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp), section 'FedRAMP overview', path list and impact-level paragraph. Checked 2026-10-02.
[^45]: Office 365 U.S. Government GCC and GCC High hold ATOs from US agencies, while Office 365 U.S. Government Defense holds a provisional ATO from DISA. Source: [Federal Risk and Authorization Management Program (FedRAMP) - Microsoft Compliance](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp), section 'Office 365 and FedRAMP', first two bullets. Checked 2026-10-02.
[^46]: Office 365 GCC is listed on the FedRAMP Marketplace under the name Office 365 (Commercial), also called Office 365 Multitenant, even though it is the government community environment. Source: [Federal Risk and Authorization Management Program (FedRAMP) - Microsoft Compliance](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp), section 'Office 365 environments', bullet 'Office 365 Government Community Cloud (GCC)'. Checked 2026-10-02.
[^47]: Microsoft lists Microsoft Teams as an in-scope FedRAMP service in each of the Office 365 GCC, GCC High and DoD environments. Source: [Federal Risk and Authorization Management Program (FedRAMP) - Microsoft Compliance](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp), section 'Office 365 applicability and in-scope services', table rows GCC, GCC High, DoD. Checked 2026-10-02.
[^48]: SOC 2 and SOC 3 reports address controls relevant to five categories: security, availability, processing integrity, confidentiality and privacy. Source: [SOC 3 - SOC for Service Organizations: Trust Services Criteria for General Use Report](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3), topic page introduction. Checked 2026-10-02.
[^49]: A SOC 2 Type 1 report examines whether controls are suitably designed, while a Type 2 report also tests the operating effectiveness of the controls during the reporting period. Source: [C5 - FAQ](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html), FAQ 'What distinguishes a type 1 SOC2 report from a SOC2 type 2 report?'. Checked 2026-10-02.
[^50]: AICPA treats SOC 3 reports as general use reports that can be freely distributed because they carry less detail than SOC 2 reports. Source: [SOC 3 - SOC for Service Organizations: Trust Services Criteria for General Use Report](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3), topic page introduction. Checked 2026-10-02.
[^51]: Cisco announced in October 2023 that Webex Calling within the Webex for Government platform is FedRAMP Moderate authorized and served from US data centers. Source: [Webex Calling with FedRAMP authorization is available for government collaboration](https://blog.webex.com/collaboration/fedramp-authorization-for-government-collaboration/), body paragraphs on availability and authorization. Checked 2026-10-02.
[^52]: Cisco's data sheet describes Webex Contact Center Enterprise for Government as a FedRAMP Moderate authorized cloud contact center operated by Cisco in FedRAMP-authorized data centers. Source: [Webex Contact Center Enterprise for Government Data Sheet](https://www.cisco.com/c/en/us/products/collateral/contact-center/webex-contact-center-enterprise/webex-cc-enterprise-govt-ds.html), product overview section. Checked 2026-10-02.
[^53]: Webex Contact Center Enterprise for Government is offered exclusively to United States federal and state agencies. Source: [Webex Contact Center Enterprise for Government Data Sheet](https://www.cisco.com/c/en/us/products/collateral/contact-center/webex-contact-center-enterprise/webex-cc-enterprise-govt-ds.html), availability section. Checked 2026-10-02.
[^54]: Zoom's trust center lists BSI C5 and an IRAP assessment among its commercial attestations, alongside FedRAMP Moderate, GovRAMP, TX-RAMP and DoD IL4 in its government section. Source: [Compliance - Zoom Trust Center](https://www.zoom.com/en/trust/legal-compliance/), commercial certifications cards 'BSI C5' and 'iRAP'; government certifications section. Checked 2026-10-02.
[^55]: Zoom's trust center lists PCI DSS for Zoom Phone and Zoom Contact Center rather than for the whole platform. Source: [Compliance - Zoom Trust Center](https://www.zoom.com/en/trust/legal-compliance/), commercial certifications, PCI DSS card. Checked 2026-10-02.
[^56]: Zoom describes its SOC 2 Type 2 report as covering Security, Availability, Confidentiality and Privacy. Source: [Compliance - Zoom Trust Center](https://www.zoom.com/en/trust/legal-compliance/), commercial certifications, SOC 2 Type 2 card. Checked 2026-10-02.
[^57]: Zoom announced that Zoom Contact Center for Zoom for Government received a FedRAMP JAB authorization at the Moderate level on 4 June 2024. Source: [Zoom Contact Center for Zoom for Government receives FedRAMP JAB authorization](https://news.zoom.com/zoom-contact-center-for-zoom-for-government-receives-fedramp-jab-authorization/), opening paragraph. Checked 2026-10-02.
[^58]: Zoom says Zoom for Government runs on AWS GovCloud and is managed by U.S. persons, and was first FedRAMP authorized in March 2019. Source: [Zoom Contact Center for Zoom for Government receives FedRAMP JAB authorization](https://news.zoom.com/zoom-contact-center-for-zoom-for-government-receives-fedramp-jab-authorization/), background paragraph. Checked 2026-10-02.
[^59]: Zoom lists Zoom Phone among the Zoom for Government products covered by its FedRAMP authorization. Source: [Zoom Contact Center for Zoom for Government receives FedRAMP JAB authorization](https://news.zoom.com/zoom-contact-center-for-zoom-for-government-receives-fedramp-jab-authorization/), list of other authorized Zoom for Government products. Checked 2026-10-02.