A complete sample: robocall mitigation plan, RMD form and CPNI certification

1Company, services and network

Brightline Voice LLC (“Brightline”) is an Ohio limited liability company that sells interconnected VoIP service — hosted PBX seats and SIP trunks — to approximately 1,400 small-business customers (about 3,200 seats) in Ohio, Indiana and Michigan. Brightline sells, onboards, bills and supports these customers. It serves no residential customers.

Brightline does not own or operate switches, session border controllers or any other network facilities used to process voice calls. Customer phones and PBXs register to a hosted platform operated by Brightline’s underlying facilities-based provider, [Platform Provider legal name] (the “Platform Provider”), which processes every call and originates outbound calls onto the public switched telephone network. Telephone numbers used by Brightline customers are obtained through the Platform Provider. Brightline does not hold direct access to numbering resources and has no Operating Company Number.

2Role in the call chain

Brightline files as a voice service provider under 47 CFR § 64.6305(d): it furnishes voice service that is interconnected with the public switched telephone network to end users, using North American Numbering Plan resources (47 CFR § 64.6300(o)). Brightline does not accept calls from other providers for onward transmission and does not receive calls directly from foreign providers; it is neither a gateway provider nor a non-gateway intermediate provider. Role selected on the submission form: “Voice Service Provider without a STIR/SHAKEN obligation.”

As 47 CFR § 64.6305(d)(1) requires, Brightline certifies that all of the calls it originates on its network are subject to the robocall mitigation program described in this plan, that no prior certification of Brightline has been removed by Commission action, and that Brightline has not been prohibited from filing in the Robocall Mitigation Database.

3STIR/SHAKEN implementation status

Brightline certifies that it has not implemented the STIR/SHAKEN authentication framework on any portion of its network (Option 3), because it lacks control over the network infrastructure necessary to implement STIR/SHAKEN (47 CFR § 64.6305(d)(1)(iii), (d)(2)(i)).

Explanation. STIR/SHAKEN authentication is performed on IP voice facilities — the switches and session border controllers that create and sign the SIP signaling of each call. Brightline has none. Calls placed by Brightline customers are processed entirely on the Platform Provider’s network; Brightline has no ability to create, sign or alter the SIP Identity header of any call, and it holds no SPC token or STIR/SHAKEN certificate. The Platform Provider, which controls this infrastructure, originates these calls onto the public switched telephone network and holds the STIR/SHAKEN implementation obligation for them. Brightline supplies the Platform Provider, on request, with the customer identity and number-assignment information the Platform Provider uses for its attestation decisions.

Brightline does not rely on the implementation extensions for small voice service providers in 47 CFR § 64.6304(a), which expired on June 30, 2022 for non-facilities-based providers and on June 30, 2023 for facilities-based providers.

If Brightline begins to own or operate IP voice switching facilities, it will obtain its own SPC token and certificate, implement STIR/SHAKEN as 47 CFR § 64.6301 requires — directly or through a third-party authentication agreement that meets § 64.6301(b) — and update this filing within 10 business days.

4Robocall mitigation program: the reasonable steps Brightline takes

Brightline’s program keeps illegal robocalls off its service before they start: it screens who may buy service, limits what a new account can do, reviews call patterns every business day, and acts on problems within one business day. Brightline follows the practices this plan describes, and every employee who onboards customers or reviews traffic is trained on them.

4.1 Knowing our customers — new and renewing (47 CFR § 64.1200(n)(4))

Before any new account can place calls, Brightline:

1. collects the customer’s legal business name, state of formation, federal Employer Identification Number, physical business address and an authorized contact;
2. verifies that the business is registered and in good standing with the Secretary of State of its state of formation, and confirms the address and EIN against one independent document, such as an IRS EIN assignment letter or a recent utility bill;
3. confirms that the person ordering service is an owner, officer or authorized employee of the business, and checks a government-issued photo ID for sole proprietors;
4. requires a payment method in the customer’s legal name and does not accept prepaid cards; and
5. records the customer’s stated calling use. Brightline does not accept customers whose primary use is outbound telemarketing, lead generation, or high-volume or automated dialing, and offers no auto-dialer or predictive-dialer features.

Every new account starts with outbound limits, set in the Platform Provider’s account controls: concurrent outbound calls are capped at the number of seats purchased, and for the first 90 days any account placing more than 200 outbound calls per seat in a day is held for review. Limits are raised only after a written review by the Director of Operations.

Renewing customers. At each contract renewal, and whenever an existing customer asks to add locations, add more than 25 numbers or raise its limits, Brightline re-verifies the customer’s registration status and contact details and reviews the account’s last 90 days of call records before approving the change.

4.2 Contract terms that prohibit illegal calling

Brightline’s customer agreement and acceptable use policy, which every customer accepts before activation and which are included in every customer contract: prohibit using the service to make illegal robocalls or to transmit misleading or inaccurate caller ID information; require compliance with the Telephone Consumer Protection Act, the Truth in Caller ID Act and the Telemarketing Sales Rule; require customers to cooperate with Brightline in responding to traceback requests; and allow Brightline to suspend outbound calling immediately, without prior notice, when it reasonably suspects illegal calling.

4.3 Caller ID controls and do-not-originate blocking (47 CFR § 64.1200(o))

Customers may present as caller ID only numbers assigned to them through Brightline, or numbers they have shown they are authorized to use — for example, numbers ported in with a signed letter of authorization and a recent invoice from the prior provider. Each account is configured so that calls presenting any other number are rejected.

Under Brightline’s agreement with the Platform Provider, outbound calls from Brightline customers that purport to originate from a number on a reasonable do-not-originate list are blocked on the platform. The list covers the categories 47 CFR § 64.1200(o) allows: numbers whose subscribers asked that calls purporting to come from them be blocked because they are used for inbound calls only; invalid numbers; valid numbers not allocated to a provider; and allocated but unused numbers, as the rule defines them. Calls to 911 are never blocked, and reasonable efforts are made not to block calls from public safety answering points and government emergency numbers (47 CFR § 64.1200(k)(5)–(6)). Each January, Brightline obtains written confirmation from the Platform Provider that this blocking is active on its traffic.

4.4 Monitoring and analytics

Brightline does not contract with a third-party call-analytics vendor and does not operate an analytics system of its own. It relies on:

• the network analytics of the Platform Provider, [Platform Provider legal name], which screen Brightline’s outbound traffic for patterns associated with illegal robocalls; and
• its own review, every business day, of the previous day’s call detail records exported from the Platform Provider’s portal. The review flags any account with more than 200 outbound calls per seat in a day; more than 60 percent of outbound calls lasting under 30 seconds; an answer rate under 25 percent across more than 100 calls; any call presenting a number not authorized for the account; or outbound volume above three times its 30-day daily average.

The Director of Operations reviews each flagged account within one business day. If the calls appear illegal, Brightline suspends the account’s outbound calling while it investigates, and terminates service where illegal calling is confirmed. Every review and its outcome are logged.

4.5 Knowing our upstream provider (47 CFR § 64.1200(n)(5))

Brightline buys voice service from one provider, the Platform Provider. It accepts no traffic from any other provider, foreign or domestic, and resells its service to no other provider.

Before contracting, Brightline confirmed that the Platform Provider’s filing appeared in the Robocall Mitigation Database, reviewed its public robocall mitigation plan, and confirmed that it was not named in any Final Determination Order in EB Docket No. 22-174. Brightline re-checks the Platform Provider’s listing in the Database on the first business day of every month. The wholesale agreement requires the Platform Provider to maintain its filing, comply with the Commission’s caller ID authentication and robocall mitigation rules, and cooperate with traceback requests.

5Traceback: commitment and procedure

Commitment. Brightline commits to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to originate calls (47 CFR § 64.6305(d)(2)(iii)).

Procedure. Traceback requests are received at [traceback email], which the Director of Operations and a named backup monitor. Brightline responds fully within 24 hours as 47 CFR § 64.1200(n)(1) measures them: a request received outside business hours (8 a.m. to 5:30 p.m. local time, Monday through Friday, excluding federal legal holidays) is treated as received at 8 a.m. on the next business day, and the clock does not run on weekends or federal legal holidays. The response identifies the Brightline customer that placed the call, or explains why the call did not come from a Brightline customer. Brightline preserves the related call detail records, suspends the customer’s outbound calling pending review when the request concerns suspected illegal calls, and cooperates with the investigation. The industry traceback consortium is currently USTelecom’s Industry Traceback Group.

6FCC notices and blocking orders

If the Enforcement Bureau sends Brightline a Notice of Suspected Illegal Traffic, Brightline will promptly investigate the identified traffic and report the results within the time the Notice sets (at least 14 days). If Brightline served as the originating provider for that traffic, it will stop it — by suspending the responsible customer accounts and, where needed, having the Platform Provider block the traffic — and its report will include a certification that it is blocking the identified traffic and will continue to do so, and a description of its plan to identify and block substantially similar traffic on an ongoing basis (47 CFR § 64.1200(n)(2)).

Brightline checks EB Docket No. 22-174 every week for Final Determination Orders. If one ever names the Platform Provider, Brightline will stop taking service from it no later than 30 days after the Order’s release (47 CFR § 64.1200(n)(3)).

7Formal actions and investigations in the prior two years

In the prior two years, neither Brightline nor any entity with which it shares common ownership, management, directors, or control has been the subject of a formal Commission, law enforcement, or regulatory agency action or investigation with accompanying findings of actual or suspected wrongdoing due to transmitting, encouraging, assisting, or otherwise facilitating illegal robocalls or spoofing, or due to a deficient Robocall Mitigation Database certification or mitigation program description (47 CFR § 64.6305(d)(2)(iv)).

8Keeping this filing accurate

Brightline reviews this plan before each annual recertification, which it completes on or before March 1 (47 CFR § 64.6305(h)), and updates its filing within 10 business days of any change to the information it contains (§ 64.6305(d)(5)) — including changes in ownership, principals, business names, address, contact person, role in the call chain, STIR/SHAKEN status, and the providers or analytics it relies on. Changes to its name, address or contact information are made in CORES within the same 10 business days (47 CFR § 1.8002(b)(2)). The Director of Operations owns this process; the Managing Member signs each certification.

9Robocall mitigation contact

[Name], Director of Operations, Operations Department, Brightline Voice LLC, [business address], [telephone], [compliance email].

1. Date filed: [February __, 2027]
2. Name of company(s) covered by this certification: Brightline Voice LLC
3. Form 499 Filer ID: [Form 499 Filer ID]
4. Name of signatory: [Name]
5. Title of signatory: Managing Member and Chief Executive Officer
6. Certification:

I, [Name], certify that I am an officer of the company named above, and acting as an agent of the company, that I have personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the Commission’s CPNI rules. See 47 CFR § 64.2001 et seq.

Attached to this certification is an accompanying statement explaining how the company’s procedures ensure that the company is in compliance with the requirements (including those mandating the adoption of CPNI procedures, training, safeguards, recordkeeping, and supervisory review) set forth in section 64.2001 et seq. of the Commission’s rules.

The company has not taken actions (i.e., proceedings instituted or petitions filed by a company at either state commissions, the court system, or at the Commission against data brokers) against data brokers in the past year.

The company has not received customer complaints in the past year concerning the unauthorized release of CPNI.

The company represents and warrants that the above certification is consistent with 47 CFR § 1.17, which requires truthful and accurate statements to the Commission. The company also acknowledges that false statements and misrepresentations to the Commission are punishable under Title 18 of the U.S. Code and may subject it to enforcement action.

Brightline Voice LLC (“Brightline”) provides interconnected VoIP service (47 CFR § 9.3) and is therefore subject to the Commission’s rules on customer proprietary network information (CPNI) (47 CFR § 64.2003(o)). This statement explains how Brightline’s operating procedures ensure that it complies with 47 CFR § 64.2001 et seq.

1How Brightline uses CPNI (§§ 64.2005, 64.2007)

Brightline uses, discloses and permits access to CPNI only as the rules allow without customer approval: to provide, bill and support the services its customers already buy, and to protect its rights and property and its customers from fraudulent, abusive or unlawful use of the service (§ 64.2005(d)). Brightline does not use, disclose or permit access to CPNI for any marketing that requires customer approval, does not sell CPNI, and does not share CPNI with affiliates or third parties for their marketing. In 2026 Brightline did not solicit opt-in or opt-out approval from any customer. If it ever does, it will first give each customer the individual notice required by § 64.2008 and will keep records of notices and approvals for at least one year (§§ 64.2007(a)(3), 64.2008(a)(2)).

2Approval status (§ 64.2009(a))

Brightline’s customer-management system carries a CPNI approval field on every account. Every account is currently set to “No approval — no marketing use,” and staff must check this field before any use of CPNI other than the uses listed in section 1.

3Training and discipline (§ 64.2009(b))

Every employee with access to customer records completes CPNI training when hired and again each year; all fourteen employees completed the 2026 session. The training covers what CPNI is, when it may and may not be used, the authentication procedures in section 7, and how to escalate a suspected breach. Brightline’s written disciplinary policy provides for discipline, up to and including termination, for any unauthorized use or disclosure of CPNI.

4Records of campaigns and third-party access (§ 64.2009(c))

Brightline ran no sales or marketing campaigns using CPNI in 2026. It keeps a log of every instance in which CPNI was disclosed or provided to a third party, or a third party was allowed access to CPNI — including responses to lawful process and access by its Platform Provider and billing vendor under confidentiality agreements — with a description of each instance. These records are kept for at least one year.

5Supervisory review of outbound marketing (§ 64.2009(d))

Any outbound marketing request for customer approval requires the prior written approval of the Managing Member. There were no such requests in 2026. Records of this review are kept for at least one year.

6Opt-out mechanism (§ 64.2009(f))

Brightline does not use an opt-out mechanism. If it adopts one, it will notify the Commission in writing within five business days of any instance in which the mechanism does not work properly to such a degree that customers’ inability to opt out is more than an anomaly.

7Safeguards on disclosure (§ 64.2010)

• Telephone. Brightline discloses call detail information on a customer-initiated call only after the customer gives the account password, which is never prompted by asking for readily available biographical information or account information. Without the password, Brightline sends the information to the address of record or calls the customer at the telephone number of record. If the customer supplies call detail information without Brightline’s help, staff discuss only that information.
• Online. Customers set up online portal access only after authentication that does not use readily available biographical or account information, and then reach CPNI with a password.
• In person. Brightline has no retail locations and discloses no CPNI in person.
• Passwords and back-up authentication. Passwords are created after authentication that does not use biographical or account information; the back-up method for a lost password does not prompt for such information; a customer who cannot authenticate must set a new password.
• Notice of account changes. Brightline notifies the customer immediately — by voicemail or text to the telephone number of record, or by mail to the address of record — whenever a password, back-up authentication response, online account or address of record is created or changed. The notice does not reveal the changed information and is not sent to the new information.
• Business customers. Brightline does not rely on the business-customer exemption in § 64.2010(g); every account follows these procedures.
• Detecting unauthorized access (§ 64.2010(a)). Access to customer records is limited by job role, account-change activity is reviewed monthly, and suspected pretexting is escalated to the Director of Operations the same business day.

8Breach notification (§ 64.2011)

If Brightline reasonably determines that a breach of its customers’ CPNI has occurred, it will notify the United States Secret Service and the Federal Bureau of Investigation electronically, through the Commission’s central reporting facility, as soon as practicable and in no event later than seven business days after that determination. It will not notify customers or disclose the breach publicly until seven full business days have passed after that notice, unless it has consulted the investigating agency about an extraordinarily urgent need to notify sooner, or the agency directs a longer delay. It then notifies the affected customers, and keeps a record of each breach and notification for at least two years. Brightline experienced no breach of CPNI in 2026.

9Actions against data brokers

Brightline took no actions against data brokers in 2026.

10Customer complaints about unauthorized release of CPNI

Brightline received no customer complaints in 2026 concerning the unauthorized release of CPNI.