Call Center Hosting Security & Compliance 2 — Questions and Answers
Question 1: What does SOC 2 compliance indicate about a CCaaS vendor?
- The vendor has passed an annual sales operations audit
- The vendor has been audited for security, availability, processing integrity, confidentiality, and/or privacy controls (Correct answer)
- The vendor uses at least 2 data centers for redundancy
- The vendor complies with FCC social media regulations
Correct answer: The vendor has been audited for security, availability, processing integrity, confidentiality, and/or privacy controls
SOC 2 is an auditing framework that validates a service provider's controls around security, availability, and data handling.
Question 2: What is 'multi-factor authentication' (MFA) and why is it important for call center agent logins?
- Using multiple screens on the agent's workstation
- Requiring two or more verification methods to log in, preventing unauthorized access even if a password is stolen (Correct answer)
- Logging in from multiple devices simultaneously
- Using different passwords for each platform
Correct answer: Requiring two or more verification methods to log in, preventing unauthorized access even if a password is stolen
MFA requires agents to verify identity through a second factor (like a mobile code) in addition to a password, significantly reducing unauthorized access risk.
Question 3: What is the principle of 'least privilege' in call center system access management?
- Giving all agents equal access to reduce complexity
- Granting users only the minimum access rights needed to perform their job functions (Correct answer)
- Prioritizing junior agents for system upgrades
- Restricting supervisors from accessing agent screens
Correct answer: Granting users only the minimum access rights needed to perform their job functions
Least privilege limits each user's access to only what's necessary for their role, minimizing the impact of insider threats or compromised accounts.
Question 4: Under TCPA regulations, what must outbound call centers obtain before calling consumers using an ATDS?
- A state telemarketing license
- Prior express written consent from the consumer (Correct answer)
- Approval from the FTC
- A do-not-call registry exemption
Correct answer: Prior express written consent from the consumer
The TCPA requires prior express written consent before placing calls using an Automated Telephone Dialing System (ATDS) to cell phones.
Question 5: What is the purpose of call center 'audit logs'?
- Recording all agent conversations for quality review
- Maintaining a tamper-evident record of system access and user actions for compliance and forensics (Correct answer)
- Logging call metrics for workforce management reports
- Tracking agent attendance and login times
Correct answer: Maintaining a tamper-evident record of system access and user actions for compliance and forensics
Audit logs record who did what and when in the system, providing an evidence trail for compliance audits, investigations, and security reviews.
Question 6: What is 'network segmentation' in the context of call center security?
- Dividing call queues into groups by geography
- Isolating different parts of the network to contain breaches and limit access between systems (Correct answer)
- Splitting bandwidth equally between agent workstations
- Segmenting call recordings by date for archival
Correct answer: Isolating different parts of the network to contain breaches and limit access between systems
Network segmentation divides the infrastructure into isolated zones so a breach in one segment cannot easily spread to others.
Call Center Hosting Security & Compliance 2
What does SOC 2 compliance indicate about a CCaaS vendor?