u/Soggy-Click-6885

Working through some scoping activities related to VoIP and voice data. If we were to allow the use of VoIP to discuss CUI over the phone, would the system then be treated as a CUI asset (I.e. cloud system would need to be FedRAMP moderate, FIPS encryption, etc.)? If they do need to be FedRAMP moderate, does anyone have recommendations for cloud solutions that don’t greatly increase the cost or know of any compensating controls, such as network segmentation, to make it so it doesn’t need to be FedRAMP moderate?

If you could provide previous experiences during assessments or references that would be greatly appreciated.