Updated: Aug 25, 2025
You are moving from a PBX that you tuned for years to a cloud model that changes who owns what. You want less kit in closets, better observability, and a clear plan for risk. This guide gives you a vendor-neutral view of the stack, the choices that matter, and the traps that still catch smart teams.
You buy three things: a control plane for identity and policy, a media plane that carries voice with low jitter and loss, and carrier reach for numbers, emergency calls, and lawful intercept. Every vendor markets features; your job is to map those features to these three planes. Ask yourself, who runs identity, who writes dial plans, who owns change windows, who signs off on emergency rules per site?
If a layer breaks, can your on-call find the cause in minutes, or do you wake four teams at once?
You will meet three patterns in the wild. Pure cloud trunks managed by the UCaaS vendor. Bring-your-own-carrier trunks that land in the cloud. Hybrid, where an on-prem SBC keeps complex routes, fax islands, or third-party kit alive. Pick per region, not per tenant. Test number porting plans with dry runs. Track CLIs, CNAM, and STIR or SHAKEN-style caller ID controls where the regulator needs them. Do not bury SBCs in a network that blocks TLS handshakes or breaks MTU.
Aim for stable MOS, not just a pass or fail. Opus gives you a range for voice on mixed networks, from low-bitrate speech to full-band audio, and it is standardised for real-time use. Keep SRTP, tune jitter buffers, and mark voice with DSCP end-to-end. If you see a loss of over one per cent on last-mile links, fix links first, then chase configs.
Questions for you: where does QoS die, what happens to DSCP in your SD-WAN, and who owns the runbook when MOS drops below your SLO?
Use TLS 1.2 or better for SIP signalling, SRTP for media, strong ciphers, and cert rotation on a set schedule. Block unauthenticated SIP from the open Internet. Pin SBC management to a jump host. Treat softphones as endpoints, not just apps, with patch and device compliance. Run phishing tests that target voice features, not only email. Keep least privilege on voice admin, with named roles and logs that someone reads.
Pick a cutover model per site. Dual run for a period, or a night cut, or a rolling wave by department. Keep anchor numbers stable while you move the rest. Use dual registration where vendors support it. Retire analog where you can, keep gateways for what you cannot move yet. Freeze PBX changes two weeks before each wave. Run a daily stand-up during cutover weeks, then a short hypercare.
Do you track these on a live dashboard that your CIO can read in two minutes?
DIY fits if you have a voice engineer for each region, strong SBC skills, and a change culture that ships small edits often. Managed fits if you want a single throat to choke for dial plan hygiene, number lifecycle, and 24x7 incident response.
This is where a partner matters. Proactive runs voice like a platform, with SLOs for MOS and jitter, error budgets, planned BCP drills, and a quarterly review that ties policy changes to user impact. You still keep keys and control, you get fewer surprises and faster fixes.
Book a Cloud Calling Readiness Workshop with Proactive. You leave with a site-by-site routing plan, a security and compliance gap list, an SLO pack for voice quality, and a 90-day migration plan you can take to the board. Write to [email protected].in today.
