Cloud UC Platform Comparison: Cisco Webex Calling vs Microsoft Teams Phone vs Zoom Phone vs RingCentral RingEX

All four platforms offer three to four PSTN delivery models. Cisco Webex Calling: Cisco Calling Plans (Cisco as carrier), Cloud Connected PSTN (certified ITSPs integrated at the cloud), and Local Gateway (on-prem CUBE or certified SBC). Microsoft Teams Phone: Microsoft Calling Plans, Operator Connect (certified landline operators with no customer SBC), Teams Phone Mobile (certified mobile operators, SIM-based single number), and Direct Routing (customer-managed certified SBC).

Zoom Phone: Zoom native PSTN, BYOC (customer carrier via SBC), and Provider Exchange (70+ countries).

RingCentral RingEX: Global RingEX native (45 countries), International Virtual Numbers (99+ for inbound), and BYOC (69+ countries).

Cisco Webex for Government (FedRAMP Moderate) covers Webex Calling. Webex Contact Center Enterprise for Government is FedRAMP Moderate authorized. Microsoft 365 supports GCC (FedRAMP Moderate), GCC High (FedRAMP High equivalent), and DoD IL5; Teams Phone is available across all three tiers. Zoom for Government is FedRAMP Moderate on dedicated U.S.

GovCloud infrastructure separate from commercial Zoom.

RingCentral for Government is FedRAMP Moderate — verify current authorization and service scope on the FedRAMP marketplace before contracting. All four require separate government-tenant provisioning and generally do not inherit commercial-tenant settings.

Kari’s Law (effective February 2020) requires direct 911 dialing without a prefix from MLTS (multi-line telephone systems) plus notification to on-premises personnel. RAY BAUM’s Act Phase 2 (effective January 6, 2022) requires a dispatchable location for non-fixed and off-premises devices. Webex Calling uses RedSky Horizon Mobility for Nomadic E911 (included in U.S. subscriptions). Teams Phone uses dynamic emergency calling with Location Information Service; Direct Routing requires additional configuration per Microsoft Learn.

Zoom Phone supports Nomadic E911 with dispatchable-location provisioning.

RingCentral uses Enhanced E911 with Emergency Response. In all four, BYOC or Direct Routing scenarios shift E911 obligation to the customer / carrier and require explicit provisioning of address data and dispatchable location.

Cisco Webex Contact Center and Webex Contact Center Enterprise are native single-vendor CCaaS with Webex Calling; the Enterprise variant is FedRAMP Moderate authorized for government. Zoom Contact Center is native to Zoom with 50 countries of documented native telephony and single-tenant billing with Zoom Phone. RingCentral RingCX is native, AI-first, and embedded in the RingCentral app with a single agent desktop.

Microsoft Teams Phone does not ship a first-party CCaaS at the same feature parity — contact center is partner-delivered (Microsoft Digital Contact Center Platform, Nice CXone, Genesys Cloud, Five9, Anywhere365) or via Microsoft Dynamics 365 Contact Center.

For organizations where contact center is a first-class workload, native CCaaS pairing typically reduces integration risk and vendor count.

Webex Calling prefers Opus (variable 6-510 kbps; typical voice 24-48 kbps) with G.722 wideband and G.711 narrowband fallback. Teams Phone uses SILK between Teams client and Cloud Media Processor, with SILK, G.711, G.722, or G.729 on the SBC leg per Microsoft Learn Direct Routing documentation. Zoom Phone supports Opus and G.722; G.711 for narrowband interop. RingCentral RingEX supports Opus, G.722, and G.711.

Per IETF / ITU-T references: G.711 PCMU/PCMA payload is 64 kbps; with RTP/UDP/IP headers plus 20 ms packetization and Ethernet overhead the on-wire rate is approximately 87 kbps per direction.

G.729 is 8 kbps payload (~31 kbps on-wire). Opus adapts dynamically. Codec choice affects bandwidth budgets, MOS (Mean Opinion Score per ITU P.800), and transcoding load on SBCs when crossing administrative domains.

Microsoft Direct Routing certified SBC list (published on learn.microsoft.com) includes AudioCodes, Ribbon Communications, Oracle Communications (Acme Packet), Cisco CUBE (IOS-XE), TE-SYSTEMS anynode, Sangoma, and Thinktel. Webex Calling Local Gateway uses Cisco CUBE on IOS-XE natively, with Ribbon, Oracle, and AudioCodes SBCs supported via CCP partner models. Zoom Phone BYOC Premise Peering and Cloud Peering are documented with AudioCodes, Ribbon, Oracle, and Cisco CUBE in vendor configuration notes.

RingCentral BYOC supports Oracle, Ribbon, AudioCodes, and Cisco CUBE per service description.

SBC high-availability (active-active or active-standby pair), failover testing under load, and certificate management are typically the single weakest link in cloud-UC PSTN design.

Per RFC 4594 and Cisco eight-class model, voice media marks DSCP EF (46), call signaling marks DSCP CS3 (24), and interactive video marks DSCP AF41 (34). The practical problem is that public internet paths strip DSCP at the ISP edge — end-to-end QoS requires MPLS, SD-WAN fabric, or dedicated peering (Microsoft ExpressRoute, Cisco Webex Edge Connect, Zoom ZMS / Zoom Node hybrid). Low-latency queue sizing at the WAN egress should be less than or equal to 33% of WAN bandwidth with strict-priority policing.

Latency budget is one-way less than or equal to 150 ms for toll-quality; jitter less than or equal to 30 ms at jitter-buffer ingress; packet loss less than or equal to 1% for G.711 (Opus FEC tolerates up to ~5%).

See the SD-WAN platform comparison for fabric-level QoS posture and the enterprise NGFW comparison for SBC perimeter placement.

Per-user license is only part of TCO. Add: PSTN carrier charges (Calling Plans vs BYOC vs Operator Connect materially differ), SBC procurement and operations if Direct Routing / Local Gateway / BYOC is chosen (hardware or virtual plus support plus certificates plus upgrades), E911 service charges where the carrier does not bundle nomadic dispatchable location, number porting, international DID, compliance recording integration and storage, endpoint refresh for certified desk phones, and migration professional services.

Contact center (Webex Contact Center, Zoom Contact Center, RingCX, or a Teams-partner CCaaS) is typically a separate license stack.

Published per-seat pricing on vendor pricing pages is a starting point, not a TCO; WiFi Hotshots builds fixed-fee comparative TCO models across all four platforms with the customer’s specific PSTN and compliance scope.

Webex Calling Local Gateway requires TLS 1.2 with the AES256-SHA256 or AES128-SHA256 cipher suite per Cisco’s Local Gateway Cisco preparation guide; TLS 1.0 and 1.1 are disabled on Webex cloud endpoints. Microsoft Teams Phone Direct Routing negotiates TLS 1.2 to the SBC per Microsoft Learn (learn.microsoft.com direct-routing-sbc-multiple-locations). Microsoft has not published TLS 1.3 SIP signaling support; TLS 1.3 on Direct Routing remains roadmap.

Zoom Phone BYOC Premise Peering documents TLS 1.2 as the signaling floor per Zoom’s BYOC-P provisioning guide (support.zoom.us). RingCentral RingEX BYOC runs TLS 1.2 or later to the customer SBC per the RingCentral Service Description. Certificate chains on every platform must chain to a public CA the provider trusts; self-signed is not accepted on any of the four.

Microsoft Calling Plans place the PSTN, number inventory, SBA (where used), and emergency routing inside the Microsoft 365 service boundary per learn.microsoft.com. The Teams Phone SLA covers the full call path and is Microsoft’s to measure. Operator Connect moves the SBC, PSTN circuits, and last-mile operations to the certified operator, and the operator publishes its own SLA while Microsoft retains the Teams client and Cloud Media Processor side.

Direct Routing places the SBC, certificates, dial-plan, voice routing policy, and carrier trunk in the customer’s operational boundary. Microsoft’s SLA covers only the Cloud Media Processor and SIP proxy ingress. Outage triage on Direct Routing lands first on the customer or the partner that built the SBC estate, not Microsoft support. The decision matters more for steady-state operations than for cutover day.

Provider Exchange is Zoom’s PSTN marketplace that lets a customer procure SIP trunking from a selection of carriers directly integrated to Zoom Phone cloud infrastructure; no customer SBC is required. Per Zoom’s BYOC and Provider Exchange documentation (support.zoom.us), the Provider Exchange list spans 70+ countries and includes carriers such as Intermedia, Voyced, Bandwidth, and Lumen among others.

Constraints: the customer picks one Provider Exchange carrier per country, number porting runs through the chosen carrier’s process, and contract terms sit between the customer and the carrier rather than Zoom. For global organizations, Provider Exchange often pairs with BYOC-P in specific countries where an incumbent carrier contract must be preserved. Native Zoom PSTN (where Zoom is the carrier) is a separate path.

Microsoft Teams Direct Routing supports Media Bypass, which routes RTP media directly between the Teams client and the SBC rather than traversing the Cloud Media Processor. Per learn.microsoft.com Direct Routing media bypass, the client and SBC exchange media via ICE candidates and must be routable to each other. Webex Calling does not offer an equivalent customer-side media bypass for Local Gateway trunks — media always terminates on Webex Media PoPs.

Zoom Phone BYOC supports direct media between the Zoom cloud data center and the SBC on both BYOC-C and BYOC-P paths. RingCentral RingEX uses a similar cloud-to-SBC media model. The implication for firewall and NAT design: media bypass widens the UDP port range required on the client side and shifts the ICE candidate collection load onto the client endpoint rather than a fixed cloud MP address range.

Webex Calling uses RFC 3265 SIP SUBSCRIBE/NOTIFY for Busy Lamp Field (BLF), shared-line appearance, and Message Waiting Indicator on Cisco multiplatform phones and third-party endpoints that register to Webex Calling; the feature subset matches the BroadWorks heritage descended from Cisco’s 2018 BroadSoft acquisition.

Microsoft Teams Phone uses proprietary Teams signaling between the Teams client and Cloud Media Processor; SUBSCRIBE/NOTIFY does not traverse the Direct Routing SBC-to-proxy hop. Zoom Phone uses proprietary Zoom signaling for presence between Zoom apps; SIP SUBSCRIBE on BYOC trunks is limited to carrier-to-SBC integration scenarios. RingCentral RingEX exposes RFC 3265 on SIP endpoints registered directly to RingCentral’s cloud. Mixed-endpoint deployments must verify the signaling model for every phone brand and firmware train against the platform documentation.

Per RFC 4594 and Cisco’s eight-class model, voice media should mark DSCP EF (decimal 46). The reality for residential broadband is that many consumer routers and ISP CPE remark or zero DSCP at the egress; both Microsoft Learn and Webex bandwidth planning docs state that DSCP preservation on public internet is not guaranteed end-to-end.

Teams and Webex clients set DSCP on the endpoint NIC when Group Policy or a client-managed QoS profile is applied. Zoom and RingCentral apps do the same via their client configuration. Past the LAN boundary, DSCP survives only on paths the customer controls — ExpressRoute, Webex Edge Connect, Zoom Node, SD-WAN overlays, MPLS. For pure consumer-internet remote workers, plan on best-effort marking and focus on bandwidth headroom and codec FEC (Opus) rather than rely on end-to-end DSCP.

Webex Calling supports T.38 fax relay on Local Gateway trunks and certified ATAs (Cisco ATA 192, Cisco SPA122) per the Webex Calling Local Gateway provisioning guide. Microsoft Teams Phone does not support T.38 on Direct Routing or Calling Plans per Microsoft Learn; fax devices must use G.711 pass-through via an SBC, a dedicated analog circuit, or cloud-fax (efax, Concord Fax Online).

Zoom Phone supports T.38 on BYOC trunks where the carrier negotiates T.38; native Zoom Phone PSTN does not. RingCentral RingEX Fax is a cloud-fax service rather than T.38 relay; legacy analog fax devices need an ATA or a separate cloud-fax account. For healthcare and legal customers with regulatory fax retention (HIPAA, SOX), the practical pattern is cloud-fax plus a documented analog-to-cloud migration, not a T.38 carrier build-out.

Webex Calling uses Webex Compliance Recording with certified partners (NICE, Verint, Dubber, Numonix, ASC, Red Box, Theta Lake) integrated through the Webex Cloud Connected Recording API. Microsoft Teams Phone uses Compliance Recording via certified partners (NICE, Verint, Numonix, ASC, Red Box, AudioCodes SmartTAP, Dubber, Theta Lake) through the Teams Compliance Recording policy and the Microsoft Graph API.

Zoom Phone offers native call recording plus third-party integrations (Theta Lake, ASC, Dubber). RingCentral RingEX offers native and partner recording. For regulated workflows: native recording is simpler but may not capture every call leg (transfer, parked, merged); SIPREC-based recording at the SBC captures every media leg at the cost of managing another system. For Dodd-Frank and MiFID II, SIPREC at the SBC is the defensible pattern; for HIPAA, native cloud recording with signed BAA usually suffices.

Microsoft signs a Business Associate Addendum that covers Microsoft 365 including Teams Phone Direct Routing, Operator Connect, and Calling Plans per Microsoft Service Trust Portal. Cisco signs a Webex BAA covering Webex Calling, Webex Meetings, Webex Contact Center, and Webex Connect per Cisco Trust Center. Zoom signs a BAA covering Zoom Phone, Zoom Meetings, and Zoom Contact Center at specific enterprise SKUs per Zoom Trust Center.

RingCentral signs a BAA covering RingEX, RingCentral Contact Center, and RingCentral Video at enterprise SKUs per RingCentral’s Trust Center. BAA scope changes with SKU — some consumer or small-business SKUs do not include BAA eligibility. Verify the signed BAA applies to the exact SKU the customer is contracted for before treating PHI as protected. No BAA, no HIPAA eligibility, regardless of platform marketing language.

Per Microsoft Learn configuring dynamic emergency calling, the Teams tenant admin populates LIS with mappings from network identifiers to civic addresses. Identifiers include subnet CIDR, switch chassis ID + port ID (via LLDP-MED from Cisco Catalyst, HPE Aruba, or Juniper EX on Cat 9000-class switches), and wireless BSSID with SSID filter.

When a Teams client dials 911, the client passes its current network identifiers to the Teams Emergency service, which looks up the LIS entry and returns the dispatchable location to the PSAP via the call path. Priority is: chassis+port match first, then BSSID, then subnet. In multi-tenant buildings, BSSID-based lookup requires SSID-specific filters so a visitor connected to a neighbor’s SSID doesn’t dispatch to the wrong floor. Test-call validation (dial 933 in North America) is the commissioning step that surfaces missing LIS entries.

Per ITU-T P.800 and G.107, the canonical targets are MOS 4.0 or higher for business voice and R-factor 80 or higher. All four cloud UC platforms report MOS in their analytics telemetry: Microsoft Teams Call Analytics, Webex Control Hub Analytics, Zoom Dashboard (Admin > Dashboard), RingCentral Quality of Service Reports.

Measured MOS is a calculated estimate (E-model derived) from observed jitter, loss, latency, and codec rather than a human-rated subjective score; reported numbers are platform-specific E-model implementations and do not compare apples-to-apples across platforms. For cross-platform monitoring, third-party probes (iPerf3, Cisco ThousandEyes, Broadcom AppNeta, Cisco Webex Edge Audit Tool, Microsoft Teams Network Assessment Tool) provide normalized measurements. The engineering rule: set alert thresholds at MOS 3.8 and loss 2% to catch problems before users do.

Typical enterprise voice jitter buffer depth is 20-60 ms on the receiver side. Microsoft Teams uses an adaptive jitter buffer that grows under observed jitter and shrinks under stable latency, documented implicitly in the Teams Network Requirements page. Webex Calling and Cisco IP phones (8800, 9800 series) use an adaptive algorithm with per-codec defaults per Cisco’s IP Phone Administration Guide.

Zoom and RingCentral apps adaptive their buffers per platform-published bandwidth planning docs. Tuning matters at two edges: trading floors where late packets are worse than lost packets and want a short fixed buffer; lossy backhauls (cellular, satellite, long-distance VPN) where a wider buffer absorbs jitter at the cost of one-way latency. For standard enterprise voice on well-engineered networks, the platform defaults are correct; do not tune unless a specific measured problem justifies it.

ExpressRoute for Microsoft Teams is a private circuit from the customer network into Microsoft’s global backbone that bypasses public internet for Teams traffic per learn.microsoft.com ExpressRoute for Microsoft Teams. Webex Edge Connect provides equivalent Equinix-hosted private peering into Webex cloud per Cisco Webex Edge Connect data sheet. Zoom offers Zoom Node (a customer-hosted hybrid pod) and direct peering to Zoom data centers per Zoom’s hybrid architecture documentation.

Cost: ExpressRoute typically runs $3,000-$10,000+ per month per 1 Gbps circuit plus port fees; Webex Edge Connect and Zoom Node carry similar backbone-grade costs. Worth-it trigger points: multi-thousand-seat deployments where public-internet MOS dips below 4.0 under load, regulated industries with data-residency concerns about public internet transit, or trading-floor and contact-center workflows where the SLA of the private circuit is load-bearing. For sub-500-seat sites, well-engineered SD-WAN fabric usually matches or beats the economics.

Microsoft Teams Direct Routing sends SIP OPTIONS every 60 seconds from the cloud to the SBC per learn.microsoft.com; the SBC must respond with 200 OK within the keepalive window or Microsoft marks the trunk degraded. Webex Calling Local Gateway uses OPTIONS ping with a 30-60 second interval per Cisco’s CUBE configuration guide.

Zoom Phone BYOC and RingCentral BYOC both use periodic OPTIONS pings with vendor-documented intervals. Failover behavior depends on this timing: a trunk marked degraded typically gets routed around by the cloud load balancer to an alternate SBC (if the customer deployed active-active). SBC HA design should assume one full keepalive interval of trunk-degraded detection plus one more interval of cloud routing update — so failover on a 60-second OPTIONS interval is typically 60-120 seconds of voice impact, not instantaneous. Sizing for concurrent calls must tolerate that convergence window.

On Direct Routing, the customer SBC CPS (calls per second) and CCS (concurrent call sessions) ceiling sets the trunk capacity. A Ribbon SBC SWe or AudioCodes Mediant 9030 handles tens of thousands of concurrent sessions; sizing against a measured 15-20% peak concurrent for knowledge workers (90% for contact centers) gives the ceiling.

Operator Connect puts capacity at the operator’s SBC, so customer-side sizing is just the DID inventory. BYOC-P (Zoom Premise Peering) mirrors Direct Routing — customer SBC sets the ceiling. BYOC-C (Zoom Cloud Peering) and Provider Exchange have no customer SBC, so capacity is the carrier’s cloud capacity and the contracted trunk size. Microsoft Calling Plans and RingCentral RingEX native have platform-side capacity — customer-side sizing is about user license count, not trunk sessions. The practical outcome: Direct Routing and BYOC-P are the scenarios where SBC sizing actually matters; the other three offload it.

Microsoft 365 GCC High achieves FedRAMP High equivalence per Microsoft Trust Center; Teams Phone runs inside GCC High. Microsoft 365 GCC and DoD provide additional tiers. Webex for Government holds FedRAMP Moderate per Cisco’s compliance portal; FedRAMP High on Webex Calling has not been announced as of 2026-04.

Zoom for Government holds FedRAMP Moderate on a dedicated U.S. GovCloud per Zoom’s compliance page. RingCentral for Government holds FedRAMP Moderate per the FedRAMP marketplace. For federal agencies at High impact level, Microsoft GCC High is the defensible Teams Phone choice; for Moderate, all four platforms have authorized paths. Verify the current authorization boundary and FedRAMP package for the exact SKU and tenant type before contracting — FedRAMP scope has changed repeatedly through the 2025-2026 cycle.

Microsoft Teams Rooms ships as Teams Rooms on Windows (Logitech Rally Bar, Crestron Flex, Yealink MeetingBar, HP Poly G7500, Lenovo ThinkSmart) and Teams Rooms on Android (Neat Bar, Logitech Rally Bar Mini, Yealink A30, Poly Studio X). Webex Rooms runs on Cisco Room Bar, Room Kit, Desk Pro, Board Pro (Cisco’s own hardware) and Webex on Android via certified partners. Zoom Rooms runs on Poly, Logitech, Yealink, Neat, and Crestron hardware certified for Zoom.

RingCentral Rooms runs on Poly Studio X, Logitech Rally, and Yealink hardware. Cross-platform device certification overlaps — Logitech Rally Bar is Teams-certified and Zoom-certified with firmware mode selection; Poly and Yealink offer multi-platform SKUs. Practical guidance: pick the room platform that matches the organization’s dominant meeting platform, don’t buy a multi-platform room expecting true switchability unless the room genuinely serves multiple meeting ecosystems daily.

SIPREC (RFC 7865/7866) defines a SIP-based Recording API where the SBC forks media to a Session Recording Server (SRS) as the call progresses. Ribbon SBC Core, AudioCodes Mediant 4000/9030, Oracle Acme Packet, and Cisco CUBE all support SIPREC. Typical architecture: SBC in the voice path forks a passive media copy plus RS-Metadata to the SRS (NICE, Verint, Red Box, ASC).

Session overhead: each recorded call doubles media bandwidth at the SBC, doubles media sessions on the SBC licensing, and adds one RTP stream per leg to the SRS. A 500-concurrent-call trading floor with 100% recording coverage needs SBC CCS licensing for 1,000 sessions and SRS storage for every leg. For Teams Phone Compliance Recording, Microsoft Graph API replaces SIPREC — but the certified partners (NICE, Verint, Theta Lake) offer SIPREC for non-Teams legacy call paths simultaneously. Plan license, storage, and bandwidth for double the base call volume.

Per Gartner’s UCaaS Worldwide Magic Quadrant dated October 2024, the five 2024 Leaders are Microsoft (Teams Phone), Cisco (Webex Calling), Zoom (Zoom Phone), RingCentral (RingEX), and 8×8 (XCaaS). Correcting a prior error: this is five Leaders, not four. The full MQ title is “Gartner Magic Quadrant for Unified Communications as a Service, Worldwide.”

For shortlist decisions, the MQ is a starting point not an endpoint. 8×8 XCaaS often appears on midmarket shortlists where the native contact center integration and international PSTN footprint fit better than an add-on CCaaS from the other four. Microsoft dominates enterprises already standardized on Microsoft 365. Cisco wins where Cisco infrastructure incumbency matters. Zoom wins where Zoom meetings already drive user behavior. RingCentral wins on standalone cloud phone + CCaaS simplicity. The MQ rankings shift year over year — always pull the current Gartner citation, not a stale reference.

Cisco acquired BroadSoft in 2018 for $1.9 billion per Cisco’s acquisition press release; BroadSoft’s flagship product BroadWorks became the underlying platform for Webex Calling. As of 2026 Webex Calling runs on a cloud-native evolution of the BroadWorks codebase, with Cisco-maintained feature parity for BroadWorks call-center, hunt group, auto-attendant, call park, call pickup, and shared-line appearance behaviors.

That heritage matters because migrations from BroadWorks-based carrier cloud voice (Verizon OneTalk, Comcast Business Voice Edge, AT&T Office@Hand-era, and many CLEC cloud voice offers) preserve numbering plans, dial-plans, and feature behaviors when landing on Webex Calling. Teams Phone, Zoom Phone, and RingCentral do not share this heritage — migrations between BroadWorks carrier cloud and those platforms often surface feature-parity gaps that require dial-plan redesign or rework of call-flow logic. For customers exiting a BroadWorks carrier cloud, Webex Calling is architecturally the softest landing.

Microsoft Calling Plans provide native PSTN in roughly 30+ countries per learn.microsoft.com country availability; Operator Connect extends coverage to 90+ countries via certified operators. Webex Calling offers Cisco Calling Plans in 30+ countries plus Cloud Connected PSTN and Local Gateway for the rest. Zoom Phone covers 70+ countries via Provider Exchange plus BYOC for extensions. RingCentral RingEX native spans 45 countries with International Virtual Numbers (99+) for inbound and BYOC (69+) for full-PSTN.

Gotchas: emergency number routing (911 U.S./CA, 999 UK, 112 EU, 000 AU) varies by carrier; local-number portability timelines differ by country regulator (Ofcom, Bundesnetzagentur, CRTC, ACMA); some countries require in-country PSTN presence (India TRAI restrictions, Brazil Anatel) that Calling Plans and Provider Exchange may not satisfy. The correct sizing pass starts with country-by-country number inventory plus regulatory flags, not a global license count.

FFIEC-regulated financial institutions (banks, BHCs, credit unions) require a CCaaS stack that meets SOX IT General Controls, FFIEC AIO guidance, and in many cases NY DFS Part 500 encryption and logging requirements. Webex Contact Center Enterprise for Government holds FedRAMP Moderate authorization per Cisco’s compliance portal, making it the platform option with federal-grade documented controls that can also be leveraged by banks for audit-defensible deployments.

Genesys Cloud, NICE CXone, and Five9 hold FedRAMP Moderate authorizations as well; Zoom Contact Center and RingCX do not currently list equivalent federal authorization. The decision axis is less about MQ ranking and more about documented control coverage: FedRAMP authorization plus SOC 2 Type II plus CJIS (for PD customer-service contact centers) plus HITRUST (for healthcare-adjacent financial services) narrow the defensible shortlist. The WFHS CC migration workstream scopes against that documented-controls matrix, not a marketing comparison.