As of 2021, the FCC actually requires certain service providers to employ a SHAKEN/STIR solution of some kind. Specifically, telecommunication companies are required to implement a SHAKEN/STIR solution if they meet the following criteria:
- They provide voice services to end-users.
- They operate their own SBC (Session Border Controller) and/or PBX (Private Branch Exchange) that routes phone calls to or from end-users.
Companies that meet these stipulations must obtain a SHAKEN certificate as well as an identifying toKEN that is unique to their business.
How are SHAKEN and STIR Different?
To better understand these protocols, it may be helpful to explore the distinctions between SHAKEN and STIR.
STIR actually refers to a working body of telecom and Internet regulators, whose initial mandate was to create a digital signature for each call. A signed call is embedded with information about the calling party, and also allows the terminating provider to verify that signature.
SHAKEN, on the other hand, refers to a set of protocols and procedures by which STIR achieves its goals.
How Do Telecom Companies Implement SHAKEN/STIR?
For telecom companies to implement SHAKEN/STIR protocols, the following steps are required:
- Registering with the STI-PA, inconectiv.
- Purchasing a SHAKEN certificate from an authorized STI-CA.
- Signing all outbound calls with that SHAKEN certificate.
- Verifying all signed inbound calls that arrive.
- Registering all required information in the Robocall Mitigation Database, as outlined by the FCC.
Note that this last step, registering with the Robocall Mitigation Database, takes just a day or two to complete, and is required for all new voice service providers. Filing a 499-A form with the FCC is also part of the process.
Additionally, voice service providers must also have an OCN (Operating Company Number) assigned by the NECA (National Exchange Carrier Association).