STIR (Secure Telephony Identity Revisited) is a set of IETF standards (RFCs 8224, 8225, 8226) that define how to cryptographically sign a SIP call so the recipient can verify who originated it. SHAKEN is the framework that says how service providers actually deploy it.

When a call enters the network, the originating provider stamps it with an Identity header that says "this caller has the right to use this number." The terminating provider checks that signature and decides whether to display the call as verified or flag it as suspicious. In the US, this was made law under the TRACED Act.

All voice service providers in the US are required to be STIR/SHAKEN compliant for the IP portions of their networks under the TRACED Act and FCC rules. This includes:

• VoIP providers

• CLECs

• Wireless carriers

• Broadband providers offering voice

• Telecommunications carriers

Even providers with TDM networks still need call authentication for the TDM portions, though not STIR/SHAKEN specifically. The rules apply to anyone originating, terminating, or routing calls.

 A (full attestation) means the originating provider knows the caller and confirms they have the right to use the number. That's the strongest level and what the FCC wants you to give when you can.

B (partial attestation) means the provider knows the caller but can't confirm the number, which comes up with PBX scenarios where calls can be forwarded with an arbitrary caller ID.

C (gateway attestation) is the weakest – basically "I don't know who placed this call, but I know who handed it to me." Picking the right level matters more each year because over-attestation gets you flagged by analytics partners. 

 For the IP portions of your network, yes. The non-IP exemption only applies to the parts that are physically non-IP. For TDM parts, you don't have to implement STIR/SHAKEN specifically because it's IP-only, but you still have to implement some form of call authentication and a robocall mitigation program. Ignoring it isn't an option. 

Not anymore. As of September 18, 2025, the FCC requires that even if you use a third party for technical signing, you have to make the attestation decisions, and the calls must be signed with your own certificate, not the third party's. You also have recordkeeping requirements for those arrangements. Make sure your contract reflects this and that you have the certificate yourself.

This is one of the more common problems. A lot of SBCs were configured years ago to drop unknown headers as a security hardening step, and the Identity header gets caught up in that.

The fix depends on the SBC—Oracle Acme Packet, Sansay, MetaSwitch Perimeta, and Ribbon all handle it differently. You also need to make sure your trunks can carry the larger SIP messages by moving to TCP. 

STIR/SHAKEN by itself doesn't prevent robocalls. It just authenticates that a caller has the right to use a number. If a legitimate provider signs a call from a customer who's actually doing illegal robocalling, the call still goes through with a valid attestation.

That's why STIR/SHAKEN has to be paired with robust analytics (Hiya, TNS, TransUnion), KYC on the origination side, traceback response, and Do-Not-Originate enforcement.

These are complementary, not competing. STIR/SHAKEN is the cryptographic layer. It tells you whether the caller is authorized to use a number.

Analytics is the reputation layer. It tells you, based on call patterns, complaint volume, and other signals, whether the caller is actually behaving well. You need both. 

Display is what your subscribers see, and that's a separate decision from either signing or analytics. 

The FCC requires every voice service provider to recertify its Robocall Mitigation Database filing every year. The window opens February 1, the deadline is March 1, and the first one was March 1, 2026. The base forfeiture for false or inaccurate RMD info is now $10,000, and there's a $1,000 penalty for failing to update within 10 business days of a change. ECG helps on the technical side, so the filing reflects what you've actually deployed.

You register as a voice service provider with the Policy Administrator (currently the Governance Authority board). You request an SPC (Service Provider Code) token. You generate a CSR from that token and submit it to an approved Certificate Authority to get your signing certificate. That certificate is what you use to sign Identity headers on outbound calls. The process also includes registering your network details in the Robocall Mitigation Database so the industry knows who you are and what you're responsible for.