Your phone system is a covered information system.

Primary-source answer

The definition names the system.

The Safeguards Rule defines an information system broadly, then removes any doubt about specialized operational systems. The text expressly includes “telephone switching and private branch exchange systems” when they contain customer information or connect to a system that does.

“Information system means a discrete set of electronic information resources … as well as any specialized system such as … telephone switching and private branch exchange systems … that contains customer information or that is connected to a system that contains customer information.”

That is not an analogy to be argued from. It is an example written into the definition at 16 CFR 314.2.

Where customer information enters the phone stack

A phone platform does not need to store a complete tax return to matter. A caller may leave a Social Security number in voicemail, discuss filing status or income, receive a callback through an integrated client record, or have a conversation recorded by the provider.

The useful assessment questions are concrete:

• Are voicemail messages retained, transcribed, emailed, or backed up?
• Are calls recorded, and who can retrieve those recordings?
• Does caller identification or a CRM integration expose client details?
• Can former staff still access the phone portal or voicemail?
• What does the provider contract say about security, deletion, and incidents?
• When information is no longer needed, what actually removes it?

The inventory comes before the conclusion.

A desk phone with no stored information and no connection to a customer-information system is not the same as a cloud PBX that emails transcripts and records calls. The rule's definition is conditional. The work is to inspect the configuration and the information flow, not to label every telephone identically.

That is why a WISP built from a generic endpoint checklist can miss the phone system entirely. The written program should describe the boundary that exists, including specialized systems, and the evidence should show how that boundary is secured.