Yes, in most defense contractors’ environments. If calls, voicemail, recordings or transcripts carry controlled unclassified information (CUI), the phone system is in CMMC Level 2 scope, and NIST SP 800-171 requirement 3.13.14 requires you to control and monitor VoIP. GCC High calling from Intuity UC keeps voice inside the same boundary as Teams.
Why it matters now
CMMC moved into contracts on November 10, 2025, when the DFARS CMMC rule took effect. Phase 2 begins November 10, 2026, when many solicitations start requiring third-party certification for Level 2 instead of self-assessment.
| Phase | Start date | What changes |
|---|---|---|
| 1 | November 10, 2025 | Level 1 and Level 2 self-assessments become a condition of award on applicable contracts |
| 2 | November 10, 2026 | Level 2 certification by an authorized third party (C3PAO) for applicable contracts |
| 3 | November 10, 2027 | Level 3 assessments by the government (DIBCAC) for applicable contracts |
| 4 | November 10, 2028 | Full implementation across applicable solicitations, contracts and option periods |
When is voice in scope?
Under CMMC Level 2, any asset that processes, stores or transmits CUI is in scope. A phone system usually qualifies when:
- engineers or program staff discuss CUI on calls,
- voicemail is delivered to email or stored in the cloud,
- calls are recorded or transcribed, or
- softphones run on the same laptops that handle CUI.
A basic lobby phone that never carries contract data may stay out of scope. Document that decision in your system security plan either way.
Which requirements apply to phones?
CMMC Level 2 assesses the 110 security requirements in NIST SP 800-171 Revision 2. NIST has since published Revision 3, but CMMC Level 2 still uses Revision 2. These are the requirements that touch voice most directly:
| Requirement | What it means for your phone system |
|---|---|
| 3.13.14 Control and monitor VoIP | Assessors check that VoIP use is controlled and monitored. An SBC with logging and call policies is the usual evidence |
| 3.13.8 Protect CUI in transit | Encrypt signaling (TLS) and media (SRTP) wherever calls carry CUI |
| 3.13.11 FIPS-validated cryptography | The encryption protecting CUI must use FIPS-validated modules |
| 3.1.1 Limit system access | Restrict who can administer the phone system, reroute numbers or pull recordings |
| 3.3.1 Audit logs | Keep records of admin changes and sign-ins on the voice platform |
For the encryption details, see voice encryption requirements for CUI.
What about your phone provider?
If a cloud provider stores, processes or transmits covered defense information, DFARS 252.204-7012 requires that provider to meet security equivalent to the FedRAMP Moderate baseline. It must also follow the clause’s incident rules, including reporting within 72 hours.
That is why voice for GCC High tenants should stay in the government boundary. Intuity UC runs its GCC High calling service from an SBC in its own Azure GCC High instance, encrypts calls with TLS and SRTP, and maps the service to DFARS 252.204-7012, NIST SP 800-171 and CMMC 2.0.
Four steps before your assessment
- Map voice flows. List desk phones, softphones, mobile apps, voicemail, recording and transcription, and mark which ones touch CUI.
- Close the easy gaps. Turn off recording or transcription where it isn’t needed, and require MFA for admin portals.
- Collect provider evidence. Get your provider’s encryption details, where its SBC runs, its logging, and its incident process in writing.
- Add voice to your SSP with the boundary decision and the controls above.
Frequently asked questions
Is VoIP in scope for CMMC?
It is when calls, voicemail, recordings or transcripts carry CUI. NIST SP 800-171 requirement 3.13.14 specifically requires organizations to control and monitor VoIP.
Which NIST 800-171 requirement covers phone systems?
Requirement 3.13.14, control and monitor the use of VoIP technologies. Requirements 3.13.8 and 3.13.11 (encryption in transit and FIPS-validated cryptography) also apply when calls carry CUI.
When does CMMC Phase 2 start?
November 10, 2026. Phase 2 adds Level 2 certification by an authorized third-party assessor (C3PAO) for applicable DoD contracts.
Does my VoIP provider need FedRAMP?
If the provider’s cloud stores, processes or transmits covered defense information, DFARS 252.204-7012 requires security equivalent to the FedRAMP Moderate baseline plus 72-hour incident reporting.
How does GCC High calling help with CMMC?
It keeps voice in the same government boundary as your GCC High tenant. Intuity UC hosts its SBC in its own Azure GCC High instance and encrypts calls with TLS and SRTP.
Sources:
NIST SP 800-171 Rev. 2 ·
DFARS 252.204-7012 ·
Arnold & Porter: CMMC final rule takeaways ·
Venable: CMMC requirements are live
